A stored cross‑site scripting vulnerability exists in Armeria when directory listing is enabled. Attackers who control the names of files can embed malicious scripts into those names. When a victim browses the directory listing, the scripts execute in the victim’s browser, potentially exposing cookies, hijacking sessions, or defacing content.

LY Corporation’s Armeria server, versions 0.80.0 through 1.42.0, is affected. The listed range shows all publicly released versions in that interval.

The CVSS score of 2.4 indicates a low severity rating. EPSS is not available and the vulnerability is not yet in the CISA KEV catalog, suggesting no widespread exploitation is recorded. However, if a deployment enables directory listing and an attacker can create or rename files, the stored XSS can be triggered. The attack vector requires file‑name control, which typically implies local or privileged access, but an exposed directory listing could be reached via the network. In the absence of a public exploit, the risk remains theoretical but should be mitigated promptly.