Stored XSS via unsanitized directory name

Cross-site scripting in SolarWinds Serv-U before 15.1.6 Hotfix 3 allows remote authenticated users to execute script via a directory name. The web interface stores an administrator-entered directory name containing JavaScript and renders it without adequate neutralization when displayed. Exploitation requires an administrator to create the malicious directory and another user to view it; the script then runs in that user's browser session and can read or alter data available to that session.