CVE - CVE-2022-21221

CVE-ID
CVE-2022-21221	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. Note: This security issue impacts Windows users only.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/valyala/fasthttp/commit/15262ecf3c602364639d465daba1e7f3604d00e8 URL:https://github.com/valyala/fasthttp/commit/15262ecf3c602364639d465daba1e7f3604d00e8 MISC:https://github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1 URL:https://github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1 MISC:https://github.com/valyala/fasthttp/issues/1226 URL:https://github.com/valyala/fasthttp/issues/1226 MISC:https://github.com/valyala/fasthttp/releases/tag/v1.34.0 URL:https://github.com/valyala/fasthttp/releases/tag/v1.34.0 MISC:https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866 URL:https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866
Assigning CNA
Snyk
Date Record Created
20220224	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20220224)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)