CVE-2022-21221

The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.

• CWE-22

• https://github.com/valyala/fasthttp/commit/15262ecf3c602364639d465daba1e7f3604d00e8Patch, Third Party Advisory
• https://github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1Patch, Third Party Advisory
• https://github.com/valyala/fasthttp/issues/1226Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/valyala/fasthttp/releases/tag/v1.34.0Release Notes, Third Party Advisory
• https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866Exploit, Patch, Third Party Advisory
• https://github.com/valyala/fasthttp/commit/15262ecf3c602364639d465daba1e7f3604d00e8Patch, Third Party Advisory
• https://github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1Patch, Third Party Advisory
• https://github.com/valyala/fasthttp/issues/1226Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/valyala/fasthttp/releases/tag/v1.34.0Release Notes, Third Party Advisory
• https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866Exploit, Patch, Third Party Advisory

Published

Mar 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21216Insufficient granularity of access control in out-of-band ma…6.8
• CVE-2022-21217An out-of-bounds write vulnerability exists in the device Te…9.8
• CVE-2022-21218Uncaught exception in the Intel(R) Trace Analyzer and Collec…5.5
• CVE-2022-21219Out-of-bounds read vulnerability in CX-Programmer v9.76.1 an…7.8
• CVE-2022-2122DOS / potential heap overwrite in qtdemux using zlib decompr…7.8
• CVE-2022-21220Improper restriction of XML external entity for Intel(R) Qua…7.8
• CVE-2022-21222The package css-what before 2.1.3 are vulnerable to Regular …7.5
• CVE-2022-21223The package cocoapods-downloader before 1.6.2 are vulnerable…9.8
• CVE-2022-21224Rejected reason: This candidate was in a CNA pool that was n…
• CVE-2022-21225Improper neutralization in the Intel(R) Data Center Manager …8
• CVE-2022-21226Out-of-bounds read in the Intel(R) Trace Analyzer and Collec…5.5
• CVE-2022-21227The package sqlite3 before 5.0.3 are vulnerable to Denial of…7.5