Stored XSS via unescaped filenames

Stored XSS in Cesanta Mongoose before 7.22 lets attackers run script in a user's browser via crafted filenames in MG_ENABLE_DIRLIST output. The printdirentry() code path reached from listdir() in src/http.c URL-encodes the href target but writes the raw filesystem filename into the HTML link text without entity encoding, so browser-parsed markup from the filename becomes active content. Exploitation requires a file-write path into a served directory and a victim who browses a directory listing; the resulting script runs in the Mongoose origin and can read session data or issue actions as that victim.