CVE-2026-121819

A vulnerability exists in armeria-xds versions 1.40.0 through 1.42.0 due to a flaw in DataSourcePolicy . The component checks filename containment without resolving symbolic links , which allows a compromised or semi-trusted xDS control plane to force the xDS client to read files outside of confi...

CVE-2026-121819

A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment without resolving symbolic links, allowing a compromised or semi-trusted xDS control plane to cause the xDS client to read files outside configured allowed root...