CVE-2021-43795

Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path.

• CWE-22

• https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284Patch, Third Party Advisory
• https://github.com/line/armeria/pull/3855Third Party Advisory
• https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcvThird Party Advisory
• https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284Patch, Third Party Advisory
• https://github.com/line/armeria/pull/3855Third Party Advisory
• https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcvThird Party Advisory

Published

Dec 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4379The WooCommerce Multi Currency plugin for WordPress is vulne…6.5
• CVE-2021-43790Lucet is a native WebAssembly compiler and runtime. There is…8.1
• CVE-2021-43791Zulip is an open source group chat application that combines…5.3
• CVE-2021-43792Discourse is an open source discussion platform. In affected…4.3
• CVE-2021-43793Discourse is an open source discussion platform. In affected…4.3
• CVE-2021-43794Discourse is an open source discussion platform. In affected…5.3
• CVE-2021-43797Netty is an asynchronous event-driven network application fr…6.5
• CVE-2021-43798Grafana is an open-source platform for monitoring and observ…7.5
• CVE-2021-43799Zulip is an open-source team collaboration tool. Zulip Serve…9.8
• CVE-2021-4380The Pinterest Automatic plugin for WordPress is vulnerable t…9.8
• CVE-2021-43800Wiki.js is a wiki app built on Node.js. Prior to version 2.5…7.5
• CVE-2021-43801Mercurius is a GraphQL adapter for Fastify. Any users from M…7.5