Vulnerability Report: GO-2022-0470

• CVE-2022-31022, GHSA-9w9f-6mg8-jp7w
• Affects: github.com/blevesearch/bleve, github.com/blevesearch/bleve/v2
• Published: Jul 15, 2022
• Modified: May 20, 2024

HTTP handlers provide unauthenticated access to the local filesystem. The Bleve http package is intended for demonstration purposes and contains no authentication, authorization, or validation of user inputs. Exposing handlers from this package can permit attackers to create files and delete directories.