CVE-2022-31259

PoC —

CVSS 3.1

9.8 critical

EPSS

22%p98

Published

May 21, 2022 (May 21, 2022)

Modified

Jun 17, 2026

Description

The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).

Vendors: beego
Products: beego
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (22.2%)

In the news0 stories

No ingested article mentions this CVE yet.