CVE-2022-21221

PoC ×2—

CVSS 3.1

7.5 high

EPSS

2%p84

Published

Mar 17, 2022 (Mar 17, 2022)

Modified

Jun 17, 2026

Description

The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.

Vendors: fasthttp project
Products: fasthttp
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (2.5%)

In the news0 stories

No ingested article mentions this CVE yet.