3.7
Low
CVE-2024-8244 The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions…
Description
The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| path/filepath | Versions not published |
References
- go.dev go.dev
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of path/filepath
The 6 CVEs of path/filepath →
CVE-2023-45284
On Windows, The IsLocal function does not correctly detect reserved device names in some cases
5.3
Medium
CVE-2023-45283
The filepath package does not recognize paths with a \??\ prefix as special
Not rated
CVE-2022-41722
A path traversal vulnerability exists in filepath.Clean on Windows
Not rated
CVE-2022-30632
Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic…
Not rated