CVE-2021-32769

    Dashboard / Vulnerabilities / CVE-2021-32769

    CVE-2021-32769

    Published: 16 Jul 2021Last Modified: 7 Aug 2026

    Summary:

    Details: Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versions prior to 2.5.9. With a basic configuration, it is possible to access any file from a filesystem, using "/../../" in the URL. This occurs because Micronaut does not restrict file access to configured paths. The vulnerability is patched in version 2.5.9. As a workaround, do not use `**` in mapping, use only `*`, which exposes only flat structure of a directory not allowing traversal. If using Linux, another workaround is to run micronaut in chroot.

    References: https://github.com/micronaut-projects/micronaut-core/commit/a0cfeb13bf1ef5d692d16d4a3b91b34b7456bb11, https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-cjx7-399x-p2rj

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -808a868902e58d343c5b38922088920a4236e580

    Affected versions

    v2.5.8
    v2.5.6
    v2.5.7
    v2.5.5
    v2.5.4
    v2.5.3
    v2.5.2
    v2.5.1
    v2.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-32769 | CVE-DB