CVE-2021-35054: 
NixOS vulnerability analysis and mitigation

Minecraft before version 1.17.1 contains a path traversal vulnerability (CVE-2021-35054) that affects servers configured with online-mode=false. This vulnerability was discovered and reported by RyotaK, with the initial disclosure made on July 20, 2021 (JVN Advisory, RyotaK Advisory).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) with a CVSS v3.1 base score of 7.5 (HIGH). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N). The scope is unchanged (S:U) with no impact on confidentiality (C:N), high impact on integrity (I:H), and no impact on availability (A:N) (NVD).

When exploited, this vulnerability allows an attacker to perform path traversal leading to the deletion of arbitrary JSON files on the system running the affected Minecraft server (JVN Advisory, RyotaK Advisory).

The primary mitigation is to update to Minecraft version 1.17.1 or later. For users unable to update, alternative workarounds include: setting 'online-mode' to 'true', verifying Minecraft usernames before handling connections, or using the latest versions of Forge 1.15.2/1.16.5 and Spigot 1.16.5/1.17 which include patches for this vulnerability (RyotaK Advisory).