CVE-2026-121822: XSS

Published Nov 6, 2026

Updated

A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored cross-site scripting (XSS) when directory listing is enabled and a user views the listing.

Event History

Nov 6, 2026

CVE Published

via MITRE·07:46 AM

Data Sourced

via MITRE·07:46 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Armeria deployments using versions 0.80.0 through 1.42.0 are exposed when directory listing is enabled and attacker-controlled file names can appear in a listed directory.

What does an attacker need to exploit the vulnerability?

An attacker needs control over a file name that is included in a directory listing. A user must then view that directory listing for the stored XSS to trigger.

CVE-2026-121822: XSS

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?