CVE-2022-41722 Path traversal on Windows in path/filepath

2023-02-2817:19:41

www.cve.org

path traversal

vulnerability

filepath.clean

windows

attack

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.7%

JSON

A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as “a/…/c:/b” into the valid path “c:\b”. This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path “.\c:\b”.

CNA Affected

[
  {
    "vendor": "Go standard library",
    "product": "path/filepath",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "path/filepath",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.19.6",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.20.0-0",
        "lessThan": "1.20.1",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "platforms": [
      "windows"
    ],
    "programRoutines": [
      {
        "name": "Clean"
      },
      {
        "name": "Abs"
      },
      {
        "name": "Dir"
      },
      {
        "name": "EvalSymlinks"
      },
      {
        "name": "Glob"
      },
      {
        "name": "IsLocal"
      },
      {
        "name": "Join"
      },
      {
        "name": "Rel"
      },
      {
        "name": "Walk"
      },
      {
        "name": "WalkDir"
      }
    ],
    "defaultStatus": "unaffected"
  }
]