GHSA-95f9-94vc-665h

Source

https://github.com/advisories/GHSA-95f9-94vc-665h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-95f9-94vc-665h/GHSA-95f9-94vc-665h.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-95f9-94vc-665h

Aliases

Published

2022-07-06T00:00:28Z

Modified

2026-07-08T06:27:57Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Path Traversal in Beego

Details

The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-06T20:01:19Z",
    "nvd_published_at": "2022-07-05T15:15:00Z",
    "severity": "CRITICAL"
}

References

Affected packages

Go / github.com/beego/beego

Package

Name: github.com/beego/beego; View open source insights on deps.dev
Purl: pkg:golang/github.com/beego/beego

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.12.11

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-95f9-94vc-665h/GHSA-95f9-94vc-665h.json"

Go / github.com/beego/beego/v2

Package

Name: github.com/beego/beego/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/beego/beego/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.0.0

Fixed

2.0.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-95f9-94vc-665h/GHSA-95f9-94vc-665h.json"