Path Traversal in com.linecorp.armeria:armeria
ImpactAn attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic.PatchesArmeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly.WorkaroundsThis vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path, e.g.For more informationIf you have any questions or comments about this advisory:Open an issue in [line/armeria](https://github.com/line/armeria)Chat with us at [Slack](https://armeria.dev/s/slack)CreditsThis vulnerability was originally reported by Abdallah Zaher ([elcayser-0x0a](https://hackerone.com/elcayser-0x0a?type=user)).