GHSA-54m3-5fxr-2f3j
High · 8.8CVSS
8.8
EPSS
—
Published
Jan 8, 2026
CISA due date
—
The record
Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | salvo | 0 | 0.88.1 |
Related vulnerabilities
- CVE-2026-22257 Salvo is a Rust web backend framework. Same vulnerability
- CVE-2026-33241 Salvo is a Rust web framework. Also affects salvo
- CVE-2026-33242 Salvo is a Rust web framework. Also affects salvo
- GHSA-pp9r-xg4c-8j4x Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing Also affects salvo
- GHSA-f842-phm9-p4v4 Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass Also affects salvo
- GHSA-rjf8-2wcw-f6mp Salvo is vulnerable to reflected XSS in the list_html function Also affects salvo
- CVE-2026-22256 Salvo is a Rust web backend framework. Also affects salvo
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79