External risk intelligence

Directory Serve Path Traversal Allows Arbitrary File Deletion

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-72569

The vulnerability affects a directory serving application, a type of software commonly deployed as a web server or file-sharing endpoint accessible from the internet to facilitate remote access or content distribution.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security issue has been identified in a file-serving application that could allow an unauthorized remote attacker to delete arbitrary files on the system if a specific command-line option is enabled. This vulnerability arises from insufficient security checks on user-supplied file path information, potentially leading to unintended data removal. The main concern at this stage is confirming if this specific application and its vulnerable configuration are in use within our environment.

Unchecked file paths permit remote deletion.
Matters if remote file deletion is a risk.
Confirm relevance and exposure of this tool.

Attack Path

How an attacker could exploit the issue

An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted request to an application running the affected code. The attacker would target the file deletion feature, providing a malicious file path that uses directory traversal sequences to escape the intended directory. If the application is launched with the delete option, this could allow the attacker to delete arbitrary files on the system.

Attacker can reach via the network.
Triggered by a crafted file deletion request.
Leads to arbitrary file deletion.

Live Threat

Current exploitation, exposure, and threat context

A remote, unauthenticated attacker could delete arbitrary files on a system running the affected software with the `--delete` option. This occurs because the application does not properly sanitize file deletion requests, allowing an attacker to navigate outside the intended directory.

Arbitrary file deletion.
Maliciously crafted deletion requests.
System data loss or corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in a directory serving application impacts systems allowing remote file deletion. Application owners or platform teams are likely responsible for addressing this, requiring immediate confirmation of affected assets and their exposure. The first practical move is to identify all instances of the affected technology, assess their reachability and business criticality, identify the accountable owner, and then plan remediation based on the identified risk.

Application owners must prioritize this.
Verify all served directories and access logs.
Plan remediation based on asset criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is cube-root/directory-serve?

cube-root/directory-serve is a software utility designed to serve files over a network, often used to share content or provide remote access to a directory. It functions as a lightweight web server that allows users to interact with files hosted on a machine, making it a common choice for quick file distribution tasks.

What is the path traversal weakness in CVE-2026-72569?

This vulnerability is a Path Traversal, classified as CWE-22. It happens when the software fails to properly clean user input before using it to identify a file. Because the application blindly trusts the provided file path, an attacker can insert special '..' sequences to 'climb' out of the designated folder and target files located anywhere on the underlying system.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specifically crafted request to the file deletion feature of the application. Crucially, the vulnerability only exists if the software was launched with the --delete command-line option enabled. If the application is running without this specific flag, the feature responsible for the deletion logic remains inactive, and this particular path traversal flaw cannot be leveraged.

Why does Halo Surface Signal categorize this as an external threat?

Halo Surface Signal flags this as an external risk because directory-serving applications are frequently deployed as internet-facing endpoints to enable remote file access. Since the vulnerability can be triggered over a network without needing authentication, any instance of this software exposed to the public internet is potentially reachable by remote attackers.

How should I respond to the CVE-2026-72569 advisory?

Begin by auditing your systems to see if cube-root/directory-serve is installed and currently running with the --delete flag. Once you identify any active instances, evaluate whether the file deletion feature is necessary for your operations. If it is not required, disable the --delete option immediately to eliminate the attack path while you coordinate a plan to update or replace the affected software.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.