Read the docs
TI-2021-19602 Aliases CVE-2021-43795GHSA-8fp4-rp6c-5gcv

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in com.linecorp.armeria:armeria

Priority LOW 36CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path.

Why it matters now

EPSS 0.01692 77th percentileScored 2026-11-07
Fix Fixed armeria (line): 1.13.4com.linecorp.armeria:armeria (Maven): 1.13.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LINE Corporationarmeriabefore 1.13.41.13.4Patch availableCNA
—com.linecorp.armeria:armeria (Maven)1.12.0 to before 1.13.41.13.4Patch availableGHSA-8fp4-rp6c-5gcv
  • armeria VendorLINE Corporation Affected before 1.13.4 Fixed in 1.13.4 Patch available CNA
  • com.linecorp.armeria:armeria (Maven) Vendor— Affected 1.12.0 to before 1.13.4 Fixed in 1.13.4 Patch available GHSA-8fp4-rp6c-5gcv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linecorp:armeria:*:*:*:*:*:*:*:*before 1.13.4VulnerableLinecorp
  • cpe:2.3:a:linecorp:armeria:*:*:*:*:*:*:*:* Versions before 1.13.4 Vulnerable ·Linecorp

Remediation

  • Fix · CNA armeria (line) Fixed in 1.13.4
  • Fix · GHSA-8fp4-rp6c-5gcv com.linecorp.armeria:armeria (Maven) Fixed in 1.13.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43795
  2. 2026-10-03 Alias added: GHSA-8fp4-rp6c-5gcv

References

Patch 1

Advisory 3

Other 1

  • TI-2024-01613 Improper authentication in LINE Corporation Armeria CVSS 3.1CRITICAL 9.1
  • TI-2023-05112 Improper certificate validation in LINE client for iOS CVSS 3.1CRITICAL 9.8
  • TI-2024-01060 Cross-site scripting in LINE Corporation Central Dogma CVSS 3.1CRITICAL 9.3
  • TI-2023-19873 Paths contain matrix variables bypass decorators CVSS 3.1HIGH 7.5
  • TI-2022-19973 LINE client for iOS before 12.17.0 might be crashed by sharing an invalid shared key of e2ee in group chat. CVSS 3.1HIGH 7.5
  • TI-2021-15992 Missing authorization in LINE Corporation Central Dogma CVSS 3.1HIGH 8.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences