CVE-2022-31836
Path Traversal in Beego
The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
- Record
CVE-2022-31836- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
- Record
CVE-2022-31836- Updated
- 2026-11-02
EUVDEUVD-2022-6301 No score
The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
- Record
EUVD-2022-6301- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-95f9-94vc-665h
Path Traversal in Beego
The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
- Record
GHSA-95f9-94vc-665h- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-95f9-94vc-665h
Path Traversal in Beego
The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
- Record
GHSA-95f9-94vc-665h- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV No score
The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
- Record
CVE-2022-31836- Updated
- 2026-11-02
OSVGO-2022-0569 No score
Path traversal in github.com/beego/beego and beego/v2
The leafInfo.match() function uses path.join() to deal with wildcard values which can lead to cross directory risk.
- Record
GO-2022-0569- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/beego/beegoGo |
before 1.12.11 | 1.12.11 |
github.com/beego/beego/v2Go |
2.0.0 up to 2.0.4 | 2.0.4 |
github.com/astaxie/beegoGo |
All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-31836 is a critical vulnerability (CVSS 9.8) in Beego, published July 5, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.66%, the 76th percentile. Fixed in github.com/beego/beego 1.12.11.
References
github.com/beego/beego/issues/4961
nvd.nist.gov/vuln/detail/CVE-2022-31836
pkg.go.dev/vuln/GO-2022-0569