Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-core
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versions prior to 2.5.9. With a basic configuration, it is possible to access any file from a filesystem, using "/../../" in the URL. This occurs because Micronaut does not restrict file access to configured paths. The vulnerability is patched in version 2.5.9. As a workaround, do not use `**` in mapping, use only `*`, which exposes only flat structure of a directory not allowing traversal. If using Linux, another workaround is to run micronaut in chroot.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| micronaut-projects | micronaut-core | before 2.5.9 | 2.5.9 | Patch available | CNA |
| — | io.micronaut:micronaut-http-server-netty (Maven) | before 2.5.9 | 2.5.9 | Patch available | GHSA-cjx7-399x-p2rj |
- micronaut-core Vendormicronaut-projects Affected before 2.5.9 Fixed in 2.5.9 Patch available CNA
- io.micronaut:micronaut-http-server-netty (Maven) Vendor— Affected before 2.5.9 Fixed in 2.5.9 Patch available GHSA-cjx7-399x-p2rj
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:objectcomputing:micronaut:*:*:*:*:*:*:*:* | before 2.5.9 | Vulnerable | micronaut-projects |
- cpe:2.3:a:objectcomputing:micronaut:*:*:*:*:*:*:*:* Versions before 2.5.9 Vulnerable ·micronaut-projects
Remediation
- Fix · CNA micronaut-core (micronaut-projects) Fixed in 2.5.9
- Fix · GHSA-cjx7-399x-p2rj io.micronaut:micronaut-http-server-netty (Maven) Fixed in 2.5.9 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-32769
- 2026-10-03 Alias added: GHSA-cjx7-399x-p2rj
References
More micronaut-projects Micronaut vulnerabilities
- TI-2026-25460 Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices CVSS 4.0HIGH 8.2
- TI-2020-06133 All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from… CVSS 3.1CRITICAL 9.8
- TI-2026-25459 Micronaut Framework vulnerable to a Denial of Service in HTML error response caching CVSS 3.1HIGH 7.5
- TI-2024-15658 micronaut-core management endpoints vulnerable to drive-by localhost attack CVSS 3.1HIGH 7.8
- TI-2022-06076 Memory leak in micronaut-core CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-32769 · CVE Program
- CVE-2021-32769 · NVD
- FIRST EPSS
- GHSA-cjx7-399x-p2rj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences