CVE-2024-32966

Static Web Server (SWS) is a tiny and fast production-ready web server suitable to serve static web files or assets. In affected versions if directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like `<img src=x onerror=alert(1)>.txt` will allow JavaScript code execution in the context of the web server’s domain. SWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least `file_name` and `current_path` could contain malicious data however. `file_uri` could also be malicious but the relevant scenarios seem to be all caught by hyper. For any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored Cross-site Scripting vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-79
• CWE-80

• https://github.com/static-web-server/static-web-server/security/advisories/GHSA-rwfq-v4hq-h7fg
• https://github.com/static-web-server/static-web-server/security/advisories/GHSA-rwfq-v4hq-h7fg

Published

May 1, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32960Improper Privilege Management vulnerability in Booking Ultra…8.8
• CVE-2024-32961Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2024-32962xml-crypto is an xml digital signature and encryption librar…10
• CVE-2024-32963Navidrome is an open source web-based music collection serve…4.2
• CVE-2024-32964Lobe Chat is a chatbot framework that supports speech synthe…9
• CVE-2024-32965Lobe Chat is an open-source, AI chat framework. Versions of …8.6
• CVE-2024-32967Zitadel is an open source identity management system. In cas…5.3
• CVE-2024-32969vantage6 is an open-source infrastructure for privacy preser…2.7
• CVE-2024-3297An issue in the Certificate Authenticated Session Establishm…6.5
• CVE-2024-32970Phlex is a framework for building object-oriented views in R…7.1
• CVE-2024-32971Apollo Router is a configurable, graph router written in Rus…9
• CVE-2024-32972go-ethereum (geth) is a golang execution layer implementatio…7.5