Not rated
CVE-2022-32190 JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path
Description
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| net/url 1.19 | 1.19.0-0 → < 1.19.1 | 1.19.1 |
Other CVEs of net/url
The 5 CVEs of net/url →
CVE-2026-56860
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer…
5.9
Medium
CVE-2026-25679
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs
7.5
High
CVE-2025-61726
The net/url package does not set a limit on the number of query parameters in a query
7.5
High
CVE-2025-47912
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host…
5.3
Medium