CVE-2021-43840

message_bus is a messaging bus for Ruby processes and web clients. In versions prior to 3.3.7 users who deployed message bus with diagnostics features enabled (default off) are vulnerable to a path traversal bug, which could lead to disclosure of secret information on a machine if an unintended user were to gain access to the diagnostic route. The impact is also greater if there is no proxy for your web application as the number of steps up the directories is not bounded. For deployments which uses a proxy, the impact varies. For example, If a request goes through a proxy like Nginx with `merge_slashes` enabled, the number of steps up the directories that can be read is limited to 3 levels. This issue has been patched in version 3.3.7. Users unable to upgrade should ensure that MessageBus::Diagnostics is disabled.

• CWE-22

• https://github.com/discourse/message_bus/commit/9b6deee01ed474c7e9b5ff65a06bb0447b4db2baPatch, Third Party Advisory
• https://github.com/discourse/message_bus/security/advisories/GHSA-xmgj-5fh3-xjmmThird Party Advisory
• https://github.com/discourse/message_bus/commit/9b6deee01ed474c7e9b5ff65a06bb0447b4db2baPatch, Third Party Advisory
• https://github.com/discourse/message_bus/security/advisories/GHSA-xmgj-5fh3-xjmmThird Party Advisory

Published

Dec 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43835Sulu is an open-source PHP content management system based o…7.2
• CVE-2021-43836Sulu is an open-source PHP content management system based o…8.8
• CVE-2021-43837vault-cli is a configurable command-line interface tool (and…9.1
• CVE-2021-43838jsx-slack is a library for building JSON objects for Slack B…7.5
• CVE-2021-43839Cronos is a commercial implementation of a blockchain. In Cr…7.5
• CVE-2021-4384The WordPress Photo Gallery – Image Gallery plugin for WordP…4.3
• CVE-2021-43841XWiki is a generic wiki platform offering runtime services f…5.4
• CVE-2021-43842Wiki.js is a wiki app built on Node.js. Wiki.js versions 2.5…5.4
• CVE-2021-43843jsx-slack is a package for building JSON objects for Slack b…7.5
• CVE-2021-43844MSEdgeRedirect is a tool to redirect news, search, widgets, …8.8
• CVE-2021-43845PJSIP is a free and open source multimedia communication lib…9.1
• CVE-2021-43846`solidus_frontend` is the cart and storefront for the Solidu…4.3