CVE-2022-29804 Path traversal via Clean on Windows in path/filepath

2022-08-0900:00:00

www.cve.org

cve-2022-29804

path traversal

windows

filepath

directory traversal attack

AI Score

7.8

Confidence

High

EPSS

0.002

Percentile

53.0%

JSON

Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.

CNA Affected

[
  {
    "vendor": "Go standard library",
    "product": "path/filepath",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "path/filepath",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.17.11",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.18.0-0",
        "lessThan": "1.18.3",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "platforms": [
      "windows"
    ],
    "programRoutines": [
      {
        "name": "Clean"
      }
    ],
    "defaultStatus": "unaffected"
  }
]