{"id":"CVE-2026-121822","kind":"vulnerability","aliases":["CVE-2026-121822"],"related":[],"title":"Armeria: file names can inject stored XSS in directory listings","description":"A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored cross-site scripting (XSS) when directory listing is enabled and a user views the listing.","summary":"Armeria versions 0.80.0 through 1.42.0 fail to escape file names in directory listings. An attacker who controls a file name can run script in the browser of anyone who views the listing.","severity":"low","cvss":2.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["armeria","file-serving","java","package"],"not_affected_if":["directory-listing-disabled","trusted-file-names"],"how_to_check":"- Check the armeria version in the project's build file (for example `armeria` in `build.gradle` or `pom.xml`) against the range 0.80.0 through 1.42.0\n- Check whether directory listing is enabled in the Armeria file service configuration","fix":"- Move to an armeria version later than `1.42.0`; the exact fixed version is unknown","status":"open","published_at":"2026-11-06T08:17:20+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","triaged_at":"2026-11-06T08:42:42+00:00","updated_at":"2026-11-06T08:42:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T08:42:42Z","model":"claude-haiku-5-5","output":{"fix":"- Move to an armeria version later than `1.42.0`; the exact fixed version is unknown","reach":"internet","title":"Armeria: file names can inject stored XSS in directory listings","impact":"medium","summary":"Armeria versions 0.80.0 through 1.42.0 fail to escape file names in directory listings. An attacker who controls a file name can run script in the browser of anyone who views the listing.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","armeria","file-serving"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in a viewer's browser on the listing page","analyst_note":"Confirm the fixed version and the exact directory listing setting from the GitHub advisory linked in the sources.","how_to_check":"- Check the armeria version in the project's build file (for example `armeria` in `build.gradle` or `pom.xml`) against the range 0.80.0 through 1.42.0\n- Check whether directory listing is enabled in the Armeria file service configuration","plain_action":"","needs_analyst":true,"not_affected_if":["directory-listing-disabled","trusted-file-names"],"who_is_affected":"Only applications built on Armeria 0.80.0 through 1.42.0 that serve files with directory listing turned on and let untrusted users create file names. Applications that do not enable directory listing, or that only serve files whose names they control, are not exposed. The sources do not say which exact listing setting is needed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000697,"input_tokens":4214,"output_tokens":552,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-121822':13A,16A '-2026':12A,15A '0.80.0':25B,63C '1.42.0':27B,65C 'anyon':50B 'armeria':1A,17B,23B,61C 'attack':37B,67C 'browser':48B 'caus':73C 'control':39B,69C 'cross':76C 'cross-sit':75C 'cve':11A,14A 'directori':9A,34B,81C 'enabl':84C 'escap':30B 'fail':28B 'file':2A,19B,31B,41B,70C 'file-serv':18B 'identifi':59C 'inject':5A 'java':21B 'list':10A,35B,54B,82C,90C 'name':3A,32B,42B,71C 'packag':22B 'run':44B 'script':45B,78C 'serv':20B 'site':77C 'store':6A,74C 'user':87C 'version':24B,62C 'view':52B,88C 'vulner':56C 'xss':7A,79C","nicknames":[],"mitigations":[],"who_affected":"Only applications built on Armeria 0.80.0 through 1.42.0 that serve files with directory listing turned on and let untrusted users create file names. Applications that do not enable directory listing, or that only serve files whose names they control, are not exposed. The sources do not say which exact listing setting is needed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["armeria","fileserving","java","low","package"],"campaign_type":null,"search_a":"'-121822':13A,16A '-2026':12A,15A 'armeria':1A 'cve':11A,14A 'directori':9A 'file':2A 'inject':5A 'list':10A 'name':3A 'store':6A 'xss':7A","search_b":"'0.80.0':25B '1.42.0':27B 'anyon':50B 'armeria':17B,23B 'attack':37B 'browser':48B 'control':39B 'directori':34B 'escap':30B 'fail':28B 'file':19B,31B,41B 'file-serv':18B 'java':21B 'list':35B,54B 'name':32B,42B 'packag':22B 'run':44B 'script':45B 'serv':20B 'version':24B 'view':52B","search_c":"'0.80.0':63C '1.42.0':65C 'armeria':61C 'attack':67C 'caus':73C 'control':69C 'cross':76C 'cross-sit':75C 'directori':81C 'enabl':84C 'file':70C 'identifi':59C 'list':82C,90C 'name':71C 'script':78C 'site':77C 'store':74C 'user':87C 'version':62C 'view':88C 'vulner':56C 'xss':79C","first_public_at":"2026-11-06T07:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"dl_cve@linecorp.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121822","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121822","severity":null,"published_at":"2026-11-06T08:17:20+00:00","modified_at":"2026-11-06T08:17:20+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","fetched_at":"2026-11-06T08:40:33+00:00","note":null}],"documents":[{"id":84762,"url":"https://github.com/line/armeria/security/advisories/GHSA-x9vf-hjgg-cq25","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T07:17:23+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}