1. Home
  2. Security Advisories
  3. Go
  4. GO-2022-0533

[GO-2022-0533] Path traversal via Clean on Windows in path/filepath

Severity High
Affected Packages 2
Fixed Packages 2
CVEs 1
Info Packages Vulnerabilities

On Windows, the filepath.Clean function can convert certain invalid paths to
valid, absolute paths, potentially allowing a directory traversal attack.

For example, Clean(".\c:") returns "c:".

Package Affected Version
pkg:golang/path/filepath >= 1.18.2, < 1.17.11
pkg:golang/path/filepath >= 1.18.2, < 1.18.3
Package Fixed Version
pkg:golang/path/filepath = 1.17.11
pkg:golang/path/filepath = 1.18.3
ID
GO-2022-0533
Severity
high
Severity from
CVE-2022-29804
URL
https://pkg.go.dev/vuln/GO-2022-0533
Published
2022-08-12T17:19:52
(2 years ago)
Modified
2024-07-17T19:54:18
(2 months ago)
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Fixed pkg:golang/path/filepath path filepath = 1.17.11
Affected pkg:golang/path/filepath path filepath >= 1.18.2 < 1.17.11
Fixed pkg:golang/path/filepath path filepath = 1.18.3
Affected pkg:golang/path/filepath path filepath >= 1.18.2 < 1.18.3
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date