{"id":"CVE-2022-40082","aliases":["EUVD-2022-6778","GHSA-c9qr-f6c8-rgxf","GO-2022-1027"],"status":"published","title":"Hertz contains path traversal via normalizePath function","description":"Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01111,"percentile":0.66188,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2022-09-28T13:34:02Z","modified":"2026-10-28T02:30:25Z","fixes":[{"ecosystem":"Go","package":"github.com/cloudwego/hertz","fixed_in":["0.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/cloudwego/hertz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cloudwego/hertz","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cloudwego/hertz","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.1"}]}]}],"products":[{"vendor":"cloudwego","product":"hertz"}],"references":[{"url":"https://github.com/cloudwego/hertz/issues/228","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/cloudwego/hertz/pull/229","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40082","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2022-1027","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c9qr-f6c8-rgxf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/40xxx/CVE-2022-40082.json","tags":["advisory"]},{"url":"https://github.com/cloudwego/hertz","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-40082","description":"Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.","status":"published","published":"2022-09-28T13:34:02Z","modified":"2025-05-21T14:45:54.81Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:30.842561Z"}],"euvd":[{"id":"EUVD-2022-6778","description":"Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.","status":"published","published":"2022-09-28T13:34:02Z","modified":"2025-05-21T14:45:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:32:41.46277Z"}],"ghsa":[{"id":"GHSA-c9qr-f6c8-rgxf","title":"Hertz contains path traversal via normalizePath function","description":"Hertz is a a high-performance and strong-extensibility Go HTTP framework that helps developers build microservices. Versions of Hertz prior to 0.3.1 contain a path traversal vulnerability via the normalizePath function. This issue has been patched in 0.3.1.","status":"published","published":"2022-09-29T00:00:26Z","modified":"2023-02-14T20:42:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:45.67005Z"}],"nvd":[{"id":"CVE-2022-40082","description":"Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.","status":"published","published":"2022-09-28T14:15:10.907Z","modified":"2026-06-17T05:00:51.273Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:29.026521Z"}],"osv":[{"id":"CVE-2022-40082","description":"Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.","status":"published","published":"2022-09-28T13:34:02Z","modified":"2026-10-28T02:30:25.902502864Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"GHSA-c9qr-f6c8-rgxf","title":"Hertz contains path traversal via normalizePath function","description":"Hertz is a a high-performance and strong-extensibility Go HTTP framework that helps developers build microservices. Versions of Hertz prior to 0.3.1 contain a path traversal vulnerability via the normalizePath function. This issue has been patched in 0.3.1.","status":"published","published":"2022-09-29T00:00:26Z","modified":"2023-11-08T04:10:22.36562Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"GO-2022-1027","title":"Path traversal in github.com/cloudwego/hertz","description":"Improper path sanitization on Windows permits path traversal attacks. Static file serving with the Static or StaticFS functions allows an attacker to access files from outside the filesystem root.\n\nThis vulnerability does not affect non-Windows systems.","status":"published","published":"2022-10-05T18:02:53Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}