CVE-2021-21290

CVE-2021-21290 is a local information disclosure vulnerability affecting Netty versions prior to 4.1.59.Final, as well as products like Debian, NetApp, Oracle, and Quarkus that utilize Netty. It arises from insecure temporary file creation on Unix-like systems when Netty's multipart decoders are configured to store uploads on disk, allowing other local users to read sensitive data from these temporary files. The vulnerability has a CVSS score of 5.5 (Medium), indicating a low attack complexity and requiring local access and privileges to exploit. The primary impact is a high risk of confidentiality compromise, as sensitive information written to temporary files can be read by other local users. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention.