JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Sep 13, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-docsUpgrade golang-testsUpgrade golang-srcUpgrade golang-sharedUpgrade golangUpgrade golang-bin | Feb 17, 2025 | Sep 6, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Sep 13, 2022 |
| Freebsd | — | Upgrade go119Upgrade go118 | Nov 4, 2022 | Sep 7, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Sep 30, 2022 | Sep 13, 2022 |
| Oracle_linux | — | Upgrade golang-testsUpgrade golang-miscUpgrade golang-binUpgrade golang-docsUpgrade golangUpgrade golang-raceUpgrade go-toolsetUpgrade golang-srcUpgrade delve | Mar 8, 2023 | Sep 6, 2022 |
| Redhat Openshift | — | Upgrade kernel-rtUpgrade containers-commonUpgrade ovn22.12Upgrade skopeoUpgrade podmanUpgrade openshift-clientsUpgrade kernelUpgrade runcUpgrade buildahUpgrade atomic-openshift-service-idlerUpgrade openshift-kuryr | Jan 26, 2023 | Sep 6, 2022 |
| Suse | — | Upgrade go1.19Upgrade go1.19-docUpgrade go1.19-race | Oct 26, 2022 | Sep 13, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | Sep 13, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub