GO-2026-4950
Authorization bypass via double-encoded paths in github.com/valyala/fasthttp
In github.com/valyala/fasthttp before 1.70.0, ServeFile and ServeFS reinterpret filesystem paths as URIs, decoding percent-encoded sequences and treating characters like '?' and '#' as URI delimiters. In applications where authorization guards inspect ctx.Path() before passing paths to file-serving handlers, double-encoded path variants (e.g., /%2561dmin/export.csv) bypass access controls while still resolving to the protected file on disk.
What each source reports
OSV No score
Authorization bypass via double-encoded paths in github.com/valyala/fasthttp
In github.com/valyala/fasthttp before 1.70.0, ServeFile and ServeFS reinterpret filesystem paths as URIs, decoding percent-encoded sequences and treating characters like '?' and '#' as URI delimiters. In applications where authorization guards inspect ctx.Path() before passing paths to file-serving handlers, double-encoded path variants (e.g., /%2561dmin/export.csv) bypass access controls while still resolving to the protected file on disk.
- Record
GO-2026-4950- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/valyala/fasthttpGo |
before 1.70.0 | 1.70.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GO-2026-4950 is a vulnerability with no CVSS score yet in github.com/valyala/fasthttp, published August 18, 2026. No source lists public exploit code. Fixed in github.com/valyala/fasthttp 1.70.0.