Non notée
CVE-2022-32190 JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path
Description
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| net/url 1.19 | 1.19.0-0 → < 1.19.1 | 1.19.1 |
Références
- groups.google.com groups.google.com
- go.dev go.dev
- go.dev go.dev
- pkg.go.dev pkg.go.dev
Chronologie
- Publiée
- Dernière modification
Autres CVE de net/url
Les 5 CVE de net/url →
CVE-2026-56860
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer…
5.9
Moyenne
CVE-2026-25679
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs
7.5
Élevée
CVE-2025-61726
The net/url package does not set a limit on the number of query parameters in a query
7.5
Élevée
CVE-2025-47912
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host…
5.3
Moyenne