Is CVE-2026-121822 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121822 being exploited in the wild.

How severe is CVE-2026-121822?

Informational severity, published 6 November 2026.

Which products and versions are affected?

LINE Armeria 0.80.0 through 1.42.0.

How is CVE-2026-121822 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-121822?

Check whether you run LINE Armeria at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121822: Armeria FileService stored XSS in directory listing

CVE-2026-121822 · Severity: info · Published 2026-11-06

Armeria is a framework for building Java-based web services. When directory listing is enabled, attackers can craft malicious file names that execute JavaScript in users' browsers when they view the directory, potentially stealing credentials or performing unauthorized actions. The vulnerability only affects non-Windows systems where special characters in file names are allowed.

Technologies: LINE Armeria. Vendors: LINE.

Quick answers

Is CVE-2026-121822 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121822 being exploited in the wild.
How severe is CVE-2026-121822?: Informational severity, published 6 November 2026.
Which products and versions are affected?: LINE Armeria 0.80.0 through 1.42.0.
Is there a fix for CVE-2026-121822?: Yes: fixed in 1.43.0. Until then: Disable autoIndex(true) unless directory listing is required; if enabled, restrict file upload permissions to prevent untrusted users from controlling file names in the served directory. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121822 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-121822?: Check whether you run LINE Armeria at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.43.0

Disable autoIndex(true) unless directory listing is required; if enabled, restrict file upload permissions to prevent untrusted users from controlling file names in the served directory.

Technical details

FileService in autoIndex mode fails to properly escape file names when rendering directory listings, allowing two attack vectors: link text is not HTML-escaped (permitting HTML injection like <img src=x onerror=...>), and href attributes accept javascript: URIs. An attacker who can control file names in a served directory exploits this by crafting names with markup or javascript: schemes; victims trigger the XSS on page load (for HTML injection) or by clicking the link (for javascript: URIs). The issue requires local file system access to plant crafted file names and affects only systems that permit special characters in file names (not Windows).

Affected products

LINE Armeria 0.80.0 through 1.42.0

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.