Vulnerability Report: GO-2022-0470

• CVE-2022-31022, GHSA-9w9f-6mg8-jp7w
• Affects: github.com/blevesearch/bleve, github.com/blevesearch/bleve/v2
• Published: Jul 15, 2022
• Modified: Jun 11, 2025

HTTP handlers provide unauthenticated access to the local filesystem. The Bleve http package is intended for demonstration purposes and contains no authentication, authorization, or validation of user inputs. Exposing handlers from this package can permit attackers to create files and delete directories.