Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2022-31836: Beego Cross-Directory Risk from Wildcard Values
CVE-2022-31836 · published 4 years ago
Summary
Beego versions below 2.0.3 can allow attackers to access unauthorized files and directories if user input is not properly sanitized. This can lead to unauthorized access to sensitive data. Update to Beego 2.0.3 or later to fix this issue.
What to do
- Update github.com beego to version 1.12.11.
- Update github.com beego to version 2.0.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | beego |
< 1.12.11 Fix: upgrade to 1.12.11
|
| go | github.com | beego |
>= 2.0.0, < 2.0.4 Fix: upgrade to 2.0.4
|
| – | beego | beego |
<= 2.0.3 cpe:2.3:a:beego:beego:*:*:*:*:*:*:*:* |
Original advisory text
The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
References
- https://github.com/beego/beego/pull/5025
- https://github.com/beego/beego/pull/5025/commits/ea5ae58d40589d249cf577a053e4905...
- https://pkg.go.dev/vuln/GO-2022-0569
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31836... Vendor Advisory
- https://github.com/advisories/GHSA-95f9-94vc-665h Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-31836 Vendor Advisory
- https://github.com/beego/beego/issues/4961 Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-22Path Traversal
Timeline
Published5 Jul 2022
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta