CVE-2026-22256: 
Rust vulnerability analysis and mitigation

CVE-2026-22256 is a reflected Cross-Site Scripting (XSS) vulnerability in the Salvo Rust web backend framework's list_html function within the serve-static crate. The flaw affects all Salvo versions prior to 0.88.1 and was disclosed on January 8, 2026, by researchers AhmedMokhtari, mwlik, and imenyoo2. The vulnerability arises because the current request path is decoded and normalized during route matching but inserted raw (unsanitized) into the generated HTML directory listing page. It carries a CVSS v3.1 base score of 8.8 (High) (Github Advisory, Salvo Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the list_html function located in crates/serve-static/src/dir.rs. The vulnerable code uses Rust's format! macro to directly interpolate current.path — derived from the raw decoded request URI — into the HTML response without HTML-encoding or sanitizing it: let mut ftxt = format!(r#"...{} {}Index of: {}"#, current.path, HTML_STYLE, header_links(&current.path)). An attacker crafts a URL containing an HTML/JavaScript payload in the path segment; because Salvo decodes percent-encoded characters during route matching, the decoded payload is reflected verbatim into the HTML. The only precondition is that the targeted directory listing root must contain at least one subdirectory, so the router matches and returns the listing page rather than a 404 (Salvo Advisory, Vulnerable Source).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by tricking them into clicking a crafted URL. The primary risks include session cookie theft, credential harvesting, phishing overlays, and malware distribution — potentially leading to full account takeover depending on the application's Content Security Policy (CSP) configuration. The CVSS scope is marked as Changed, reflecting that the browser (a separate security scope from the server) is the impacted component, with high confidentiality impact and low integrity and availability impact (Github Advisory, Salvo Advisory).

No evidence of active in-the-wild exploitation or weaponized exploit kits has been reported as of the time of disclosure. The GitHub Security Advisory includes a proof-of-concept video demonstrating the attack, making the exploitation technique publicly known. The EPSS score is approximately 0.013% (2nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Salvo Advisory).

1. Reconnaissance: Identify web applications built with the Salvo framework (versions ≤ 0.88.0) that expose directory listing endpoints using StaticDir with auto_list(true) enabled.
2. Verify precondition: Confirm that the target directory listing root contains at least one subdirectory (e.g., styles/, scripts/, uploads/bla/), which is required for the router to return the listing HTML page rather than a 404 Not Found response.
3. Craft malicious URL: Construct a URL where the path segment after the listing root contains an HTML/JavaScript payload. Because Salvo percent-decodes the path during route matching, encode the payload — for example: http://target.com/files/%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E/bla where %3Cscript%3E...%3C%2Fscript%3E decodes to <script>alert(document.cookie)</script>.
4. Deliver to victim: Send the crafted URL to a target user via phishing email, chat message, or embedded link. When the victim clicks the link, their browser requests the URL from the vulnerable Salvo server.
5. Trigger XSS: The server decodes the path, inserts it unsanitized into the list_html HTML response, and the victim's browser executes the injected JavaScript — enabling cookie theft, session hijacking, or further client-side attacks (Salvo Advisory, Github Advisory).

• Network: HTTP GET requests to directory listing endpoints (e.g., /files/...) containing percent-encoded HTML special characters (%3C, %3E, %22, %27) or JavaScript keywords (script, onerror, onload) in the URL path.
• Logs: Web server access logs showing requests to StaticDir-served paths with encoded payloads in the path component; HTTP 200 responses to paths containing <script> or event handler strings after URL decoding.
• Browser/Client Side: Unexpected JavaScript execution or alert dialogs when navigating to directory listing pages; anomalous outbound requests from the victim's browser to attacker-controlled domains (e.g., for cookie exfiltration) originating from the application's origin.

The primary remediation is to upgrade Salvo to version 0.88.1 or later, which patches the list_html function to properly HTML-encode current.path before inserting it into the response (Salvo Advisory, Github Advisory). As a temporary workaround if upgrading is not immediately possible, disable directory listing by removing .auto_list(true) from StaticDir configurations. Additionally, deploying a strict Content Security Policy (CSP) header (e.g., Content-Security-Policy: default-src 'self') can significantly reduce the impact of any reflected XSS by blocking inline script execution.

The vulnerability was covered by The Hacker Wire in a dedicated article on the Salvo web framework reflected XSS issue. The advisory was published by the Salvo maintainer (chrislearn) on January 8, 2026, and credited three external security researchers (AhmedMokhtari, mwlik, imenyoo2) for responsible disclosure. Community aggregators including CIRCL, VulnDB, and INCIBE-CERT picked up the advisory shortly after publication (The Hacker Wire, Salvo Advisory).