CVE-2022-41722Path Traversal in Standard Library Path Filepath

CWE-22Path Traversal8 documents7 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 39.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedFeb 28

Description

A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

CVEListV5go_standard_library/path_filepath1.20.0-01.20.1+1
NVDgolang/go< 1.19.6+1

🔴Vulnerability Details

4
CVEList
Path traversal on Windows in path/filepath2023-02-28
OSV
CVE-2022-41722: A path traversal vulnerability exists in filepath2023-02-28
GHSA
GHSA-fp44-cj2j-3jhx: A path traversal vulnerability exists in filepath2023-02-28
OSV
Path traversal on Windows in path/filepath2023-02-16

📋Vendor Advisories

3
Red Hat
golang: path/filepath: path-filepath filepath.Clean path traversal2023-02-15
Microsoft
Path traversal on Windows in path/filepath2023-02-14
Debian
CVE-2022-41722: golang-1.15 - A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, ...2022
CVE-2022-41722 — Path Traversal | cvebase