CVE-2026-25557: Reflected XSS in Evoluted PHP Directory Listing Script 4.0.5

Technical summary

The vulnerability exists in index.php where the 'dir' parameter value is reflected unsanitized into two separate locations: the HTML title element and href attributes within breadcrumb navigation anchors. By crafting payloads that break out of the title tag context or inject event handlers (such as onerror or onclick) into anchor elements, an attacker can execute arbitrary JavaScript in the victim's browser context. The application fails to HTML-encode user-supplied input before outputting it, violating fundamental XSS prevention practices. This is a classic reflected XSS flaw (CWE-79) where the malicious payload travels in the URL query string rather than being stored server-side.

Business impact

For organizations deploying Evoluted PHP Directory Listing Script, this vulnerability creates a social engineering vector. Attackers can distribute malicious links via email, chat, or forums that exploit end users when clicked. Compromised sessions could allow unauthorized access to files served by the directory listing interface, data exfiltration, or lateral movement if the script runs in a privileged context. The low barrier to exploitation and reliance on user trust in links makes this a credible threat in targeted phishing campaigns or supply-chain scenarios where attackers control link distribution channels.

Affected systems

Evoluted PHP Directory Listing Script version 4.0.5 and all earlier versions are vulnerable. Any installation accessible over the network using affected versions is at risk. The impact depends on deployment context—directory listing endpoints publicly exposed on the internet face higher risk than those on internal networks with restricted access. Organizations using this script for file sharing, software distribution, or documentation hosting should prioritize inventory and assessment.

Exploitability

This is a reflected XSS vulnerability with low complexity and no authentication required, but it does require user interaction (clicking a malicious link). An attacker crafts a URL like: http://target.com/index.php?dir=<script>alert('xss')</script> or exploits the anchor href context to inject event handlers. The attack succeeds in any browser without special conditions—no CSRF tokens, browser quirks, or advanced techniques needed. While not as dangerous as stored XSS or pre-authentication RCE, the ease of crafting payloads and delivering them via social engineering makes practical exploitation straightforward.

Remediation

Upgrade Evoluted PHP Directory Listing Script to a patched version that implements proper HTML encoding of user input. When upgrading, test the directory listing functionality to ensure breadcrumb navigation and title elements render correctly. Additionally, implement Content Security Policy (CSP) headers as a defense-in-depth measure to restrict script execution. For environments where patching is delayed, disable public access to the directory listing endpoint or restrict it to trusted IP ranges until a fix is applied.

Patch guidance

Check the vendor's release notes for versions after 4.0.5 that address input sanitization in the dir parameter handling. Apply the patch through your standard update procedures, backing up your current configuration first. Verify that breadcrumb navigation and directory titles display correctly after patching, and test with special characters and path traversal sequences to ensure the fix doesn't introduce new issues or break legitimate functionality. If the vendor provides a specific commit hash or advisory, reference those to confirm you have the correct build.

Detection guidance

Monitor web server logs for requests to index.php containing suspicious characters in the 'dir' parameter—look for script tags, event handlers (onerror, onclick, onload), JavaScript protocol handlers (javascript:), or HTML metacharacters (< > " '). Implement Web Application Firewall (WAF) rules that block common XSS patterns in query parameters. Track HTTP requests where the dir parameter value appears in the response HTML, particularly in title or href contexts, as an additional validation step. Correlate with browser-side detection if users report unexpected script execution or session hijacking attempts.

Why prioritize this

Although rated MEDIUM severity, this vulnerability merits prompt attention because: (1) exploitation requires minimal technical skill, (2) no authentication or special conditions are needed, (3) it targets end users directly through social engineering rather than requiring infrastructure compromise, and (4) directory listing scripts are often deployed in trusted contexts (internal file shares, documentation sites) where users may be less skeptical of links. Organizations with public-facing instances or those relying on this script for collaborative file access should prioritize patching within 30 days.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) reflects a network-accessible vulnerability with low attack complexity and no privilege requirements, but mitigated by the requirement for user interaction and limited scope (confidentiality and integrity impact, no availability impact). The score appropriately captures that while the attack is easy to perform, its impact is bounded to individual sessions and data accessible through the web interface rather than system-wide compromise. Organizations should not interpret MEDIUM as 'low priority'—XSS vulnerabilities are frequently exploited in real-world campaigns and form the basis for more sophisticated attacks.

Frequently asked questions