{"id":"CVE-2022-21221","aliases":["EUVD-2022-1419","GHSA-fx95-883v-4q4h","GO-2022-0355","SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866"],"status":"published","title":"Directory Traversal","description":"The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.02496,"percentile":0.84911,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2022-03-17T11:21:09Z","modified":"2026-10-28T02:30:30Z","fixes":[{"ecosystem":"Go","package":"github.com/valyala/fasthttp","fixed_in":["1.34.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/valyala/fasthttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/valyala/fasthttp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.34.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/valyala/fasthttp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.34.0"}]}]}],"products":[{"vendor":"fasthttp_project","product":"fasthttp"}],"references":[{"url":"https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","advisory","web"]},{"url":"https://github.com/valyala/fasthttp/issues/1226","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","report","web"]},{"url":"https://github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/valyala/fasthttp/commit/15262ecf3c602364639d465daba1e7f3604d00e8","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/valyala/fasthttp/releases/tag/v1.34.0","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21221","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0355","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fx95-883v-4q4h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21221.json","tags":["advisory"]},{"url":"https://github.com/valyala/fasthttp","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-21221","title":"Directory Traversal","description":"The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.","status":"published","published":"2022-03-17T11:21:09.487Z","modified":"2024-09-16T18:34:58.514Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:34:29.057251Z"}],"euvd":[{"id":"EUVD-2022-1419","description":"The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.","status":"published","published":"2022-03-17T11:21:09Z","modified":"2024-09-16T18:34:58Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:55:31.048035Z"}],"ghsa":[{"id":"GHSA-fx95-883v-4q4h","title":"Path traversal in github.com/valyala/fasthttp","description":"The package github.com/valyala/fasthttp before 1.34.0 is vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.","status":"published","published":"2022-03-18T00:01:11Z","modified":"2024-05-20T20:47:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:50.750599Z"}],"nvd":[{"id":"CVE-2022-21221","description":"The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.","status":"published","published":"2022-03-17T12:15:08.087Z","modified":"2026-06-17T04:25:46.757Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:14.24948Z"}],"osv":[{"id":"CVE-2022-21221","title":"Directory Traversal","description":"The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.","status":"published","published":"2022-03-17T11:21:09.487Z","modified":"2026-10-28T02:30:30.469839605Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"GHSA-fx95-883v-4q4h","title":"Path traversal in github.com/valyala/fasthttp","description":"The package github.com/valyala/fasthttp before 1.34.0 is vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.","status":"published","published":"2022-03-18T00:01:11Z","modified":"2026-07-08T06:49:38.03351112Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"GO-2022-0355","title":"Path traversal in github.com/valyala/fasthttp","description":"The fasthttp.FS request handler is vulnerable to directory traversal attacks on Windows systems, and can serve files from outside the provided root directory.\n\nURL path normalization does not handle Windows path separators (backslashes), permitting an attacker to construct requests with relative paths.","status":"published","published":"2022-07-27T20:26:59Z","modified":"2026-07-08T06:49:38.03351112Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}