Vulnerability · Published Feb 28, 2023 · Assigned by Go
CVE-2022-41722Path traversal on Windows in path/filepath
High 7.5
In plain English
A high-severity security flaw in path/filepath from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-1.19 | 1.19.6-2 | DEBIAN-CVE-2022-41722 |
| Go | stdlib | 1.19.6, 1.20.1 | GO-2023-1568 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | path/filepath | 0 – before 1.19.61.20.0-0 – before 1.20.1 |