CVE-2021-32769

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versions prior to 2.5.9. With a basic configuration, it is possible to access any file from a filesystem, using "/../../" in the URL. This occurs because Micronaut does not restrict file access to configured paths. The vulnerability is patched in version 2.5.9. As a workaround, do not use `**` in mapping, use only `*`, which exposes only flat structure of a directory not allowing traversal. If using Linux, another workaround is to run micronaut in chroot.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jul 16, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-32777.2Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in CVE-2021-327707.5Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic CVE-2021-327718.1Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflo CVE-2021-327728.8Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious characters CVE-2021-327737.5Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluate CVE-2021-327745.4DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no pr CVE-2021-327756.5Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field valu CVE-2021-327768.8Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Win CVE-2021-327778.3Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when e CVE-2021-327787.5Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’CVE-2021-327798.3Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy CVE-2021-32789.8Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection . Using this vulnera