GO-2026-4950

In github.com/valyala/fasthttp before 1.70.0, ServeFile and ServeFS reinterpret filesystem paths as URIs, decoding percent-encoded sequences and treating characters like '?' and '#' as URI delimiters. In applications where authorization guards inspect ctx.Path() before passing paths to file-serving handlers, double-encoded path variants (e.g., /%2561dmin/export.csv) bypass access controls while still resolving to the protected file on disk.

Database specific

{
    "url": "https://pkg.go.dev/vuln/GO-2026-4950",
    "review_status": "REVIEWED"
}

References

Credits

- Ali Firas (thesmartshadow)

Affected packages

Go / github.com/valyala/fasthttp

Package

Name: github.com/valyala/fasthttp; View open source insights on deps.dev
Purl: pkg:golang/github.com/valyala/fasthttp

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.70.0

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/valyala/fasthttp",
            "symbols": [
                "RequestCtx.SendFile",
                "RequestCtx.SendFileBytes",
                "ServeFS",
                "ServeFile",
                "ServeFileBytes",
                "ServeFileBytesUncompressed",
                "ServeFileUncompressed"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-4950.json"