https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 03:57:54 +0000 https://cve.radiocsirt.org/vuln/cnvd-2021-103087 cnvd-2021-103087 https://cve.radiocsirt.org/vuln/cnvd-2021-103087 https://cve.radiocsirt.org/vuln/euvd-2026-32653 EUVD-2026-32653 https://cve.radiocsirt.org/vuln/euvd-2026-32653 https://cve.radiocsirt.org/vuln/fkie_cve-2021-43795 <p>Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server&#39;s local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria&#39;s path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path.</p> <p>Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server&#39;s local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria&#39;s path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-43795 https://cve.radiocsirt.org/vuln/ghsa-8fp4-rp6c-5gcv <p><strong>Affected:</strong> Maven: com.linecorp.armeria:armeria</p> <p>### Impact</p> <p>An attacker can access an Armeria server&#39;s local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria&#39;s path validation logic.</p> <p>### Patches</p> <p>Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly.</p> <p>### Workarounds</p> <p>This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path, e.g.</p> <p>```java Server .builder() .serviceUnder( &#34;/files&#34;, FileService .of(...) .decorate((delegate, ctx, req) -&gt; { String path = req.headers().path(); if (path.contains(&#34;%2f&#34;) || path.contains(&#34;%2F&#34;)) { return HttpResponse.of(HttpStatus.BAD_REQUEST); } return delegate.serve(ctx, req); }) ) .build() ```</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory: * Open an issue in [line/armeria](https://github.com/line/armeria) * Chat with us at [Slack](https://armeria.dev/s/slack)</p> <p>### Credits</p> <p>This vulnerability was originally reported by Abdallah Zaher ([elcayser-0x0a](https://hackerone.com/elcayser-0x0a?type=user)).</p> <p><strong>Affected:</strong> Maven: com.linecorp.armeria:armeria</p> <p>### Impact</p> <p>An attacker can access an Armeria server&#39;s local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria&#39;s path validation logic.</p> <p>### Patches</p> <p>Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly.</p> <p>### Workarounds</p> <p>This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path, e.g.</p> <p>```java Server .builder() .serviceUnder( &#34;/files&#34;, FileService .of(...) .decorate((delegate, ctx, req) -&gt; { String path = req.headers().path(); if (path.contains(&#34;%2f&#34;) || path.contains(&#34;%2F&#34;)) { return HttpResponse.of(HttpStatus.BAD_REQUEST); } return delegate.serve(ctx, req); }) ) .build() ```</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory: * Open an issue in [line/armeria](https://github.com/line/armeria) * Chat with us at [Slack](https://armeria.dev/s/slack)</p> <p>### Credits</p> <p>This vulnerability was originally reported by Abdallah Zaher ([elcayser-0x0a](https://hackerone.com/elcayser-0x0a?type=user)).</p> https://cve.radiocsirt.org/vuln/ghsa-8fp4-rp6c-5gcv https://cve.radiocsirt.org/vuln/gsd-2021-43795 gsd-2021-43795 https://cve.radiocsirt.org/vuln/gsd-2021-43795