JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Sep 13, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-testsUpgrade golang-binUpgrade golang-docsUpgrade golang-miscUpgrade golang-sharedUpgrade golang-srcUpgrade golang-raceUpgrade golang | Feb 17, 2025 | Sep 6, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Sep 13, 2022 |
| Freebsd | — | Upgrade go118Upgrade go119 | Nov 4, 2022 | Sep 7, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Sep 30, 2022 | Sep 13, 2022 |
| Oracle_linux | — | Upgrade go-toolsetUpgrade delveUpgrade golang-srcUpgrade golang-binUpgrade golang-raceUpgrade golang-miscUpgrade golang-testsUpgrade golangUpgrade golang-docs | Mar 8, 2023 | Sep 6, 2022 |
| Redhat Openshift | — | Upgrade kernel-rtUpgrade containers-commonUpgrade runcUpgrade ovn22.12Upgrade skopeoUpgrade openshift-clientsUpgrade atomic-openshift-service-idlerUpgrade kernelUpgrade podmanUpgrade buildahUpgrade openshift-kuryr | Jan 26, 2023 | Sep 6, 2022 |
| Suse | — | Upgrade go1.19-raceUpgrade go1.19-docUpgrade go1.19 | Oct 26, 2022 | Sep 13, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | Sep 13, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub