Description
The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/astaxie/beego | all versions | — | GO-2022-0569 |
| Go | github.com/beego/beego | < 1.12.11 | 1.12.11 | GHSA-95f9-94vc-665h |
| Go | github.com/beego/beego/v2 | >= 2.0.0, < 2.0.4 | 2.0.4 | GHSA-95f9-94vc-665h |