{"id":"CVE-2021-32769","aliases":["GHSA-cjx7-399x-p2rj"],"url":"https://o3.security/vulnerability/CVE-2021-32769","summary":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-core","details":"With a basic configuration like\n\n```yaml\nrouter:\n  static-resources:\n    assets:\n      enabled: true\n      mapping: /.assets/public/**\n      paths: file:/home/lstrmiska/test/\n```\n\nit is possible to access any file from a filesystem, using \"/../../\" in URL, as Micronaut does not restrict file access to configured paths. \n\n**Repro Steps**\n- create a file test.txt in /home/lstrmiska\n- start micronaut\n- execute command\n`curl -v --path-as-is \"http://localhost:8080/.assets/public/../test.txt\"`\n\n\n### Impact\n\nMicronaut can potentially leak sensitive information.\n\nSee https://cwe.mitre.org/data/definitions/22.html\n\n### Patches\n\n```\ndiff --git a/core/src/main/java/io/micronaut/core/io/file/DefaultFileSystemResourceLoader.java b/core/src/main/java/io/micronaut/core/io/file/DefaultFileSystemResourceLoader.java\nindex 2f5a91403..19d3b7f05 100644\n--- a/core/src/main/java/io/micronaut/core/io/file/DefaultFileSystemResourceLoader.java\n+++ b/core/src/main/java/io/micronaut/core/io/file/DefaultFileSystemResourceLoader.java\n@@ -69,6 +69,9 @@ public class DefaultFileSystemResourceLoader implements FileSystemResourceLoader\n     @Override\n     public Optional<InputStream> getResourceAsStream(String path) {\n         Path filePath = getFilePath(normalize(path));\n+        if (pathOutsideBase(filePath)) {\n+            return Optional.empty();\n+        }\n         try {\n             return Optional.of(Files.newInputStream(filePath));\n         } catch (IOException e) {\n@@ -79,7 +82,7 @@ public class DefaultFileSystemResourceLoader implements FileSystemResourceLoader\n     @Override\n     public Optional<URL> getResource(String path) {\n         Path filePath = getFilePath(normalize(path));\n-        if (Files.exists(filePath) && Files.isReadable(filePath) && !Files.isDirectory(filePath)) {\n+        if (!pathOutsideBase(filePath) && Files.exists(filePath) && Files.isReadable(filePath) && !Files.isDirectory(filePath)) {\n             try {\n                 URL url = filePath.toUri().toURL();\n                 return Optional.of(url);\n@@ -117,4 +120,15 @@ public class DefaultFileSystemResourceLoader implements FileSystemResourceLoader\n     private Path getFilePath(String path) {\n         return baseDirPath.map(dir -> dir.resolve(path)).orElseGet(() -> Paths.get(path));\n     }\n+\n+    private boolean pathOutsideBase(Path path) {\n+        if (baseDirPath.isPresent()) {\n+            Path baseDir = baseDirPath.get();\n+            if (path.isAbsolute() == baseDir.isAbsolute()) {\n+                Path relativePath = baseDir.relativize(path);\n+                return relativePath.startsWith(\"..\");\n+            }\n+        }\n+        return false;\n+    }\n }\n-- \n\n```\n\n### Workarounds\n\n- do not use ** in mapping, use only * which exposes only flat structure of a directory not allowing traversal\n- run micronaut in chroot (linux only)\n\n### References\n\nSee https://cwe.mitre.org/data/definitions/22.html\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Github](https://github.com/micronaut-projects/micronaut-core/issues)\n* Email us at [info@micronaut.io](mailto:info@micronaut.io)\n","published":"2021-07-16T19:15:07.893Z","modified":"2026-08-07T19:48:37.571554Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.01732,"percentile":0.76513,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Maven","name":"io.micronaut:micronaut-http-server-netty","fixedVersion":"2.5.9"}],"fix":{"url":"https://github.com/micronaut-projects/micronaut-core/commit/a0cfeb13bf1ef5d692d16d4a3b91b34b7456bb11","label":"micronaut-projects/micronaut-core@a0cfeb1"},"references":[{"type":"FIX","url":"https://github.com/micronaut-projects/micronaut-core/commit/a0cfeb13bf1ef5d692d16d4a3b91b34b7456bb11"},{"type":"FIX","url":"https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-cjx7-399x-p2rj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32769"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T19:48:37.571554Z"}}