CVE-2026-121822 · Package
NO FIX YET · SEE WHAT TO DO
Armeria versions 0.80.0 through 1.42.0 fail to escape file names in directory listings. An attacker who controls a file name can run script in the browser of anyone who views the listing.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only applications built on Armeria 0.80.0 through 1.42.0 that serve files with directory listing turned on and let untrusted users create file names. Applications that do not enable directory listing, or that only serve files whose names they control, are not exposed. The sources do not say which exact listing setting is needed.
Not affected if directory-listing-disabled, trusted-file-names
Who cares armeria, file-serving, java
armeria in build.gradle or pom.xml) against the range 0.80.0 through 1.42.01.42.0; the exact fixed version is unknownA vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored cross-site scripting (XSS) when directory listing is enabled and a user views the listing.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.