CVE-2025-65754: 
Homebrew vulnerability analysis and mitigation

CVE-2025-65754 is a stored Cross-Site Scripting (XSS) vulnerability in Algernon, a self-contained Go-based web server, affecting version 1.17.4 and earlier (all versions below 1.17.5). The flaw allows attackers to execute arbitrary JavaScript in a victim's browser by injecting crafted XSS payloads into filenames that are rendered unsanitized in directory listings. It was discovered by researcher Benoit H. (Bnyt7) and published on December 10, 2025, with a patch released the same day. The CVSS v3.1 base score is 6.1 (Medium), while the GitHub Advisory assigns a CVSS v4 score of 5.1 (Moderate) (Github Advisory, PoC Gist).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in Algernon's directory listing handler. In engine/dirhandler.go (lines 80–108), filenames are retrieved directly from the filesystem via item.Name() and passed to themes.HTMLLink(). The HTMLLink function in themes/html.go (lines 124–132) inserts the filename as raw HTML text without any escaping, allowing embedded HTML/JavaScript to be rendered by the browser. An attacker who can place files with malicious names in a directory served by Algernon — either through a file upload feature or shared hosting access — can trigger the XSS when any user browses that directory listing (PoC Gist, CVE PoC Repo).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session when they visit a directory listing page on the affected Algernon server. This can lead to session hijacking via cookie theft, unauthorized modification of web page content, and potential credential harvesting. The confidentiality and integrity of the victim's browser session are compromised, though the server itself is not directly affected and availability is not impacted (Github Advisory, CVE PoC Repo).

Public proof-of-concept exploit code is available in two locations published by the discoverer: a GitHub Gist and a dedicated CVE repository (PoC Gist, CVE PoC Repo). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.005% (1st percentile), indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to place files in a directory served by Algernon, which limits the attack surface to shared hosting or application environments with file upload functionality.

1. Identify a target: Locate an Algernon v1.17.4 (or earlier) instance that serves directory listings and allows file creation or upload in a served directory.
2. Craft malicious filenames: Create files whose names contain XSS payloads. For example:
   • touch "<script>alert(1)</script>.txt" for a simple alert
   • touch "<img src=x onerror=alert(document.location)>.svg" for an event-handler-based payload
3. Place files in the served directory: Upload or create these files in any directory that Algernon serves without an index file, so the directory listing is rendered.
4. Trigger victim interaction: Lure a victim (e.g., an administrator or site visitor) to browse the directory listing URL (e.g., http://target:3000/malicious-dir/).
5. XSS executes: When the directory listing is rendered, Algernon's HTMLLink function inserts the raw filename into the HTML response without escaping, causing the browser to execute the embedded JavaScript payload — enabling cookie theft, session hijacking, or content manipulation (PoC Gist, CVE PoC Repo).

• File System: Presence of files with names containing HTML/JavaScript special characters (e.g., <, >, script, onerror, alert) in directories served by Algernon.
• Logs: Algernon access logs showing GET requests to directory listing URLs followed by unusual outbound connections or requests to attacker-controlled domains from client IPs.
• Network: Unexpected HTTP requests from victim browsers to external domains (e.g., for cookie exfiltration) originating after visiting an Algernon directory listing page.
• Logs: Web server logs containing URL-encoded XSS strings (e.g., %3Cscript%3E, %3C/script%3E) in directory path requests.

Upgrade Algernon to version 1.17.5 or later, which patches this vulnerability by properly HTML-escaping filenames before inserting them into directory listing output (CVE PoC Repo, Github Advisory). The fix commit is cd8832014a624a9aeab60566434c3344135e23f8. As a temporary workaround, disable directory listing functionality or restrict file creation/upload permissions in directories served by Algernon. Additionally, deploying a Web Application Firewall (WAF) to detect and block XSS payloads in HTTP responses can reduce risk until patching is completed.