CVE-2022-21221

The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. Note: This security issue impacts Windows users only...

CVE-2022-21221

CVE-2022-21221 affects the Go fasthttp package (github.com/valyala/fasthttp) prior to v1.34.0, enabling directory traversal via ServeFile when a backslash (%5c) path separator is used. The issue is noted to impact Windows systems due to path normalization differences. A patch was released in fast...