CVE-2022-21221

Directory Traversal

5.9 MediumFix available

The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. Note: This security issue impacts Windows users only.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

2.50%Up 1.5 points since Mar 18, 2022

What each source reports

CVE List Score used 5.9

Directory Traversal

Record: CVE-2022-21221
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

EUVDEUVD-2022-1419 5.9

Record: EUVD-2022-1419
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fx95-883v-4q4h 7.5

Path traversal in github.com/valyala/fasthttp

The package github.com/valyala/fasthttp before 1.34.0 is vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. Note: This security issue impacts Windows users only.

Record: GHSA-fx95-883v-4q4h
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

NVD 5.9

Record: CVE-2022-21221
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

OSV 5.9

Directory Traversal

Record: CVE-2022-21221
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVGHSA-fx95-883v-4q4h 7.5

Path traversal in github.com/valyala/fasthttp

Record: GHSA-fx95-883v-4q4h
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

OSVGO-2022-0355 No score

Path traversal in github.com/valyala/fasthttp

The fasthttp.FS request handler is vulnerable to directory traversal attacks on Windows systems, and can serve files from outside the provided root directory.

URL path normalization does not handle Windows path separators (backslashes), permitting an attacker to construct requests with relative paths.

Record: GO-2022-0355
Updated: 2026-11-02

Affected products

fasthttp project fasthttp

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/valyala/fasthttp` Go	before 1.34.0	1.34.0

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-21221 is a medium vulnerability (CVSS 5.9) in Fasthttp Project Fasthttp, published March 17, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.50%, the 84th percentile. Fixed in github.com/valyala/fasthttp 1.34.0.

References

Show 4 moreShow less