CVE-2026-22257 Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names
Attackers can execute arbitrary scripts via malicious filenames in Salvo's file listing feature if public uploads are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-22257?
CVE-2026-22257 is a high-severity cross-site scripting vulnerability in salvo-rs salvo, published on 8 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generates a file view of a folder without sanitizing the files or folders names, this may potentially lead to XSS in cases where a website allow the access to public files using this feature and anyone can upload a file. This issue has been patched in version 0.88.1.
Weakness: CWE-79
Which versions are affected by CVE-2026-22257?
2 open source packages ship an affected version, including salvo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
salvo crates.io | All versions | 0.88.1 |
salvo crates.io | All versions | 0.88.1 |
Products include Salvo Salvo.
How do I fix CVE-2026-22257?
Upgrade salvo to 0.88.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-22257 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22257 exists.
Other vulnerabilities in salvo-rs salvo
Sources
Also known as GHSA-54m3-5fxr-2f3j.