CVE-2026-121822 Details
Description
A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored cross-site scripting (XSS) when directory listing is enabled and a user views the listing.
A stored cross-site scripting vulnerability has been identified in Armeria versions 0.80.0 prior to 1.43.0. When directory listing is enabled, attackers can inject malicious scripts into file names, which are then executed when a user views the directory listing. This issue arises because the 'FileService' component does not properly escape file names before rendering them in the directory listing HTML. The vulnerability is exploitable in environments where untrusted users can upload files, except on Windows where certain characters are restricted in file names.
Users are advised to update Armeria to version 1.43.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/line/armeria/security/advisories/GHSA-x9vf-hjgg-cq25 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://line.github.io/security-advisory-blog/CVE-2026-121822/ | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| LINE Armeria | >= 0.80.0, < 1.43.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | New CVE Received | [email protected] |