A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Feb 28, 2023 |
| Amazon Linux Ami 2 | — | Upgrade golang-testsUpgrade golang-miscUpgrade golangUpgrade golang-binUpgrade golang-raceUpgrade golang-docsUpgrade golang-sharedUpgrade golang-src | Apr 21, 2023 | Feb 28, 2023 |
| Amazon_linux | — | Upgrade golang | Apr 21, 2023 | Feb 14, 2023 |
| Amazon_linux_2023 | — | Upgrade golang-miscUpgrade golang-docsUpgrade golangUpgrade golang-srcUpgrade golang-testsUpgrade golang-binUpgrade golang-raceUpgrade golang-shared | Feb 17, 2025 | Feb 15, 2023 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Feb 28, 2023 |
| Freebsd | — | Upgrade go119Upgrade go120 | Feb 17, 2023 | Feb 15, 2023 |
| Redhat Openshift | — | Upgrade openshiftUpgrade openshift-clientsUpgrade cri-oUpgrade cri-tools | Jun 8, 2023 | Feb 15, 2023 |
| Suse | — | Upgrade go1.19-docUpgrade go1.20Upgrade go1.20-raceUpgrade go1.20-docUpgrade go1.19Upgrade go1.19-race | Mar 15, 2023 | Feb 28, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 28, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub