{"id":"GO-2026-4950","title":"Authorization bypass via double-encoded paths in github.com/valyala/fasthttp","summary":"Authorization bypass via double-encoded paths in github.com/valyala/fasthttp","severity":"none","vendor":"valyala","product":"github.com/valyala/fasthttp","ecosystem":"go","affected":["github.com/valyala/fasthttp < 1.70.0"],"patched":["github.com/valyala/fasthttp 1.70.0"],"published":"2026-08-18","updated":"2026-08-19","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-4950","references":[{"url":"https://github.com/golang/vulndb/issues/4950"},{"url":"https://github.com/valyala/fasthttp/pull/2163"},{"url":"https://gist.github.com/thesmartshadow/af53acdfe0d6ce352d14eb86cecf5a08"},{"url":"https://github.com/valyala/fasthttp/releases/tag/v1.70.0"}],"tags":["osv","go"],"ingestedAt":"2026-08-19T19:22:24.372Z","slug":"GO-2026-4950","body":"## Overview\n\nIn github.com/valyala/fasthttp before 1.70.0, ServeFile and ServeFS reinterpret filesystem paths as URIs, decoding percent-encoded sequences and treating characters like '?' and '#' as URI delimiters. In applications where authorization guards inspect ctx.Path() before passing paths to file-serving handlers, double-encoded path variants (e.g., /%2561dmin/export.csv) bypass access controls while still resolving to the protected file on disk.\n\n## Affected packages\n\n- `github.com/valyala/fasthttp < 1.70.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/valyala/fasthttp 1.70.0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}