Not rated
CVE-2022-29804 Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and…
Description
Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| path/filepath 1.18 | 1.18.0-0 → < 1.18.3 | 1.18.3 |
| path/filepath 1.17 | earliest → < 1.17.11 | 1.17.11 |
References
- go.dev go.dev
- go.googlesource.com go.googlesource.com
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of path/filepath
The 6 CVEs of path/filepath →
CVE-2024-8244
The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions…
3.7
Low
CVE-2023-45284
On Windows, The IsLocal function does not correctly detect reserved device names in some cases
5.3
Medium
CVE-2023-45283
The filepath package does not recognize paths with a \??\ prefix as special
Not rated
CVE-2022-41722
A path traversal vulnerability exists in filepath.Clean on Windows
Not rated