Path Traversal in Beego

CRITICAL 9.8CVE-2022-31836 · GHSA-95f9-94vc-665h · GO-2022-0569 · Published 05/07/2022 · updated 17/06/2026

In short

CVE-2022-31836 is a CRITICAL (CVSS 9.8) vulnerability affecting github.com/astaxie/beego, github.com/beego/beego, github.com/beego/beego/v2.
Chance of exploitation in the next 30 days (EPSS): 1.7%, higher than 76.7% of all vulnerabilities.
Fix: update to 1.12.11, 2.0.4 or later.

The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.

NVD description

The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

all versions

No fix yet

< 1.12.11

1.12.11

≥ 2.0.0, < 2.0.4

2.0.4

≤ 2.0.3

No fix yet

More vulnerabilities in github.com/astaxie/beego

See all →