A Cross-Site Scripting vulnerability in the Salvo web framework allows unauthenticated attackers to execute malicious scripts in the context of a user session.

The vulnerability exists due to improper sanitization of file and directory names within the list_html function. An unauthenticated attacker can leverage this flaw to perform XSS attacks if the application allows public access to directories containing user-uploaded files.

Successful exploitation of this vulnerability can lead to unauthorized script execution in the browser of any user viewing the directory listing. This may result in session hijacking, theft of sensitive user data, or unauthorized actions performed on behalf of authenticated users, severely impacting the integrity and confidentiality of the web application. The high CVSS score of 8.8 reflects the potential for significant compromise of user sessions.

Immediate Action: Update the Salvo framework to version 0.88.1 or later to implement the necessary input sanitization.

Proactive Monitoring: Review application logs for suspicious file upload activity and monitor for unusual traffic patterns targeting directory listing endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious payloads from incoming requests and restrict public access to sensitive directory listing features until the update is applied.

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available.

Given the severity of this Cross-Site Scripting flaw and the presence of a proof-of-concept, organizations using the Salvo framework must prioritize the update to version 0.88.1. Failure to patch allows attackers to compromise user sessions, making an immediate upgrade the most effective method to mitigate this critical risk.