CVE-2026-72569: Cube-Root Directory-Serve

Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days.

A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option.

Affected products

• Cube-Root Directory-Serve: up to and including 1.3.7

Published 2026-08-10. Last modified 2026-08-28.