{"id":"CVE-2022-21221","aliases":["GHSA-fx95-883v-4q4h","GO-2022-0355","SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866"],"title":"Path traversal in github.com/valyala/fasthttp","summary":"Path traversal in github.com/valyala/fasthttp","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","vendor":"valyala","product":"github.com/valyala/fasthttp","ecosystem":"go","affected":["github.com/valyala/fasthttp < 1.34.0"],"patched":["github.com/valyala/fasthttp 1.34.0"],"published":"2022-03-18","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-fx95-883v-4q4h","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21221"},{"url":"https://github.com/valyala/fasthttp/issues/1226"},{"url":"https://github.com/valyala/fasthttp/commit/15262ecf3c602364639d465daba1e7f3604d00e8"},{"url":"https://github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1"},{"url":"https://github.com/valyala/fasthttp"},{"url":"https://github.com/valyala/fasthttp/releases/tag/v1.34.0"},{"url":"https://pkg.go.dev/vuln/GO-2022-0355"},{"url":"https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866"}],"tags":["osv","go"],"epss":0.02496,"epssPercentile":0.83994,"ingestedAt":"2026-07-09T18:56:36.364Z","slug":"CVE-2022-21221","body":"## Overview\n\nThe package github.com/valyala/fasthttp before 1.34.0 is vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.\n\n## Affected packages\n\n- `github.com/valyala/fasthttp < 1.34.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/valyala/fasthttp 1.34.0`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.5,"exploitation":0,"ransomware":0},"changes":[]}