{"id":"GO-2022-0355","summary":"Path traversal in github.com/valyala/fasthttp","details":"The fasthttp.FS request handler is vulnerable to directory traversal attacks on Windows systems, and can serve files from outside the provided root directory.\n\nURL path normalization does not handle Windows path separators (backslashes), permitting an attacker to construct requests with relative paths.","aliases":["CVE-2022-21221","GHSA-fx95-883v-4q4h","SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866"],"modified":"2026-07-08T06:49:38.033511120Z","published":"2022-07-27T20:26:59Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2022-0355","review_status":"REVIEWED"},"references":[{"type":"FIX","url":"https://github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1"},{"type":"WEB","url":"https://github.com/valyala/fasthttp/issues/1226"},{"type":"WEB","url":"https://github.com/valyala/fasthttp/releases/tag/v1.34.0"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866"}],"affected":[{"package":{"name":"github.com/valyala/fasthttp","ecosystem":"Go","purl":"pkg:golang/github.com/valyala/fasthttp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.34.0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/valyala/fasthttp","symbols":["AppendBrotliBytes","AppendBrotliBytesLevel","AppendDeflateBytes","AppendDeflateBytesLevel","AppendGunzipBytes","AppendGzipBytes","AppendGzipBytesLevel","AppendHTTPDate","AppendInflateBytes","AppendUnbrotliBytes","Args.WriteTo","Client.CloseIdleConnections","Client.Do","Client.DoDeadline","Client.DoRedirects","Client.DoTimeout","Client.Get","Client.GetDeadline","Client.GetTimeout","Client.Post","Cookie.AppendBytes","Cookie.Cookie","Cookie.Parse","Cookie.ParseBytes","Cookie.String","Cookie.WriteTo","Dial","DialDualStack","DialDualStackTimeout","DialTimeout","Do","DoDeadline","DoRedirects","DoTimeout","FS.NewRequestHandler","FSHandler","FileLastModified","GenerateTestCertificate","Get","GetDeadline","GetTimeout","HostClient.CloseIdleConnections","HostClient.Do","HostClient.DoDeadline","HostClient.DoRedirects","HostClient.DoTimeout","HostClient.Get","HostClient.GetDeadline","HostClient.GetTimeout","HostClient.Post","LBClient.Do","LBClient.DoDeadline","LBClient.DoTimeout","ListenAndServe","ListenAndServeTLS","ListenAndServeTLSEmbed","ListenAndServeUNIX","NewStreamReader","ParseByteRange","ParseHTTPDate","ParseIPv4","PipelineClient.Do","PipelineClient.DoDeadline","PipelineClient.DoTimeout","PipelineClient.PendingRequests","Post","Request.Body","Request.BodyGunzip","Request.BodyInflate","Request.BodyUnbrotli","Request.BodyWriteTo","Request.ContinueReadBody","Request.ContinueReadBodyStream","Request.Host","Request.MultipartForm","Request.PostArgs","Request.Read","Request.ReadBody","Request.ReadLimitBody","Request.SetBodyStreamWriter","Request.SetHost","Request.SetHostBytes","Request.String","Request.SwapBody","Request.URI","Request.Write","Request.WriteTo","RequestCtx.FormFile","RequestCtx.FormValue","RequestCtx.Host","RequestCtx.IfModifiedSince","RequestCtx.MultipartForm","RequestCtx.Path","RequestCtx.PostArgs","RequestCtx.PostBody","RequestCtx.QueryArgs","RequestCtx.Redirect","RequestCtx.RedirectBytes","RequestCtx.SendFile","RequestCtx.SendFileBytes","RequestCtx.SetBodyStreamWriter","RequestCtx.String","RequestCtx.URI","RequestHeader.Add","RequestHeader.AddBytesK","RequestHeader.AddBytesKV","RequestHeader.AddBytesV","RequestHeader.Read","RequestHeader.ReadTrailer","RequestHeader.Set","RequestHeader.SetByteRange","RequestHeader.SetBytesK","RequestHeader.SetBytesKV","RequestHeader.SetBytesV","RequestHeader.SetCanonical","RequestHeader.SetReferer","RequestHeader.SetRefererBytes","RequestHeader.Write","Response.Body","Response.BodyGunzip","Response.BodyInflate","Response.BodyUnbrotli","Response.BodyWriteTo","Response.Read","Response.ReadBody","Response.ReadLimitBody","Response.SendFile","Response.SetBodyStreamWriter","Response.String","Response.SwapBody","Response.Write","Response.WriteDeflate","Response.WriteDeflateLevel","Response.WriteGzip","Response.WriteGzipLevel","Response.WriteTo","ResponseHeader.Add","ResponseHeader.AddBytesK","ResponseHeader.AddBytesKV","ResponseHeader.AddBytesV","ResponseHeader.AppendBytes","ResponseHeader.Cookie","ResponseHeader.DelClientCookie","ResponseHeader.DelClientCookieBytes","ResponseHeader.Header","ResponseHeader.Read","ResponseHeader.ReadTrailer","ResponseHeader.Set","ResponseHeader.SetBytesK","ResponseHeader.SetBytesKV","ResponseHeader.SetBytesV","ResponseHeader.SetCanonical","ResponseHeader.SetContentRange","ResponseHeader.SetCookie","ResponseHeader.SetLastModified","ResponseHeader.String","ResponseHeader.Write","ResponseHeader.WriteTo","SaveMultipartFile","Serve","ServeConn","ServeFile","ServeFileBytes","ServeFileBytesUncompressed","ServeFileUncompressed","ServeTLS","ServeTLSEmbed","Server.AppendCert","Server.AppendCertEmbed","Server.ListenAndServe","Server.ListenAndServeTLS","Server.ListenAndServeTLSEmbed","Server.ListenAndServeUNIX","Server.Serve","Server.ServeConn","Server.ServeTLS","Server.ServeTLSEmbed","Server.Shutdown","TCPDialer.Dial","TCPDialer.DialDualStack","TCPDialer.DialDualStackTimeout","TCPDialer.DialTimeout","URI.Parse","URI.Update","URI.UpdateBytes","URI.WriteTo","WriteBrotli","WriteBrotliLevel","WriteDeflate","WriteDeflateLevel","WriteGunzip","WriteGzip","WriteGzipLevel","WriteInflate","WriteMultipartForm","WriteUnbrotli","bigFileReader.Read","bigFileReader.WriteTo","ctxLogger.Printf","firstByteReader.Read","flushWriter.Write","fsFile.NewReader","fsSmallFileReader.WriteTo","hijackConn.Close","hijackConn.Read","perIPConn.Close","perIPConnCounter.Unregister","pipelineConnClient.Do","pipelineConnClient.DoDeadline","pipelineConnClient.PendingRequests","requestStream.Read","statsWriter.Write","tcpKeepaliveListener.Accept","workerPool.Serve"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2022-0355.json"}}],"schema_version":"1.7.5","credits":[{"name":"egovorukhin"}]}