Stored XSS Vulnerability in Armeria by Line Corporation
CVE-2026-121822

2.4LOW

Key Information:

Vendor

Ly Corporation

Status
Armeria
Vendor
CVE Published:
6 November 2026

What is CVE-2026-121822?

A stored cross-site scripting vulnerability has been discovered in Armeria, impacting versions 0.80.0 to 1.42.0. This flaw arises when directory listing is enabled, allowing attackers with control over file names to inject malicious scripts. When users view the directory listing, these scripts can execute within their browsers, potentially compromising user data and session integrity.

Affected Version(s)

Armeria 0.80.0 < 1.43.0

References

https://line.github.io/security-advisory-blog/CVE-2026-12...
https://github.com/line/armeria/security/advisories/GHSA-...

CVSS V4

Score:
2.4
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.