Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
1 selected

3 records

Release: LY Armeria 1.43.0 Clear all filters
TI-2026-85776 CVE-2026-121822

Armeria Stored XSS via File Names in Directory Listing

Priority LOW 11

A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored cross-site scripting (XSS) when directory listing is enabled and a user views the lis…

CVSS 4.0LOW 2.4 Local Low privileges User interaction EPSS 0.00115 Published 2026-11-06 Fixed in 1.43.0
TI-2026-85775 CVE-2026-121821

Path restrictions ignored by any-origin CORS policy in LY Corporation Armeria

Priority LOW 24

A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path restrictions, allowing an attacker-controlled website visited by an authenticat…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00324 Published 2026-11-06 Fixed in 1.43.0
TI-2026-85773 CVE-2026-121819

Armeria xDS reads files outside allowed roots via symbolic links

Priority LOW 26

A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment without resolving symbolic links, allowing a compromised or semi-trusted xDS control p…

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00325 Published 2026-11-06 Fixed in 1.43.0