Lack of data validation - Path Traversal In github.com/valyala/fasthttp
Description
Authorization bypass via double-encoded paths in github.com/valyala/fasthttp In github.com/valyala/fasthttp before 1.70.0, ServeFile and ServeFS reinterpret filesystem paths as URIs, decoding percent-encoded sequences and treating characters like '?' and '#' as URI delimiters. In applications where authorization guards inspect ctx.Path() before passing paths to file-serving handlers, double-encoded path variants (e.g., /%2561dmin/export.csv) bypass access controls while still resolving to the protected file on disk.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 go | 1.70.0 |
Aliases
1. 2.
References
1. 2. 3. 4.