Read the docs
TI-2022-13707 Aliases CVE-2022-31836GHSA-95f9-94vc-665h

The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with…

Priority MEDIUM 45CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.

Why it matters now

EPSS 0.01663 76th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed github.com/beego/beego (Go): 1.12.11github.com/beego/beego/v2 (Go): 2.0.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/beego/beego (Go)before 1.12.111.12.11Patch availableGHSA-95f9-94vc-665h
—github.com/beego/beego/v2 (Go)2.0.0 to before 2.0.42.0.4Patch availableGHSA-95f9-94vc-665h
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/beego/beego (Go) Vendor— Affected before 1.12.11 Fixed in 1.12.11 Patch available GHSA-95f9-94vc-665h
  • github.com/beego/beego/v2 (Go) Vendor— Affected 2.0.0 to before 2.0.4 Fixed in 2.0.4 Patch available GHSA-95f9-94vc-665h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:beego:beego:*:*:*:*:*:*:*:*up to 2.0.3Vulnerablebeego
  • cpe:2.3:a:beego:beego:*:*:*:*:*:*:*:* Versions up to 2.0.3 Vulnerable ·beego

Remediation

  • Fix · GHSA-95f9-94vc-665h github.com/beego/beego (Go) Fixed in 1.12.11 Advisory →
  • Fix · GHSA-95f9-94vc-665h github.com/beego/beego/v2 (Go) Fixed in 2.0.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31836
  2. 2026-10-03 Alias added: GHSA-95f9-94vc-665h

References

Exploit 1

Advisory 2

Other 4

  • TI-2025-21559 Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input CVSS 3.1CRITICAL 9.6
  • TI-2022-13292 The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to… CVSS 3.1CRITICAL 9.8
  • TI-2021-10653 An issue was discovered in the route lookup process in beego before 1.12.11 that allows… CVSS 3.1CRITICAL 9.8
  • TI-2024-26936 An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via… CVSS 3.1HIGH 8.8
  • TI-2024-26937 An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via… CVSS 3.1HIGH 8.8
  • TI-2024-36951 Beego Vulnerable to Collision Hazards of MD5 in Cache Key Filenames CVSS 4.0MEDIUM 6.9
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences