JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Sep 13, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-raceUpgrade golang-sharedUpgrade golang-srcUpgrade golangUpgrade golang-miscUpgrade golang-testsUpgrade golang-docsUpgrade golang-bin | Feb 17, 2025 | Sep 6, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Sep 13, 2022 |
| Freebsd | — | Upgrade go118Upgrade go119 | Nov 4, 2022 | Sep 7, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Sep 30, 2022 | Sep 13, 2022 |
| Oracle_linux | — | Upgrade golang-srcUpgrade go-toolsetUpgrade delveUpgrade golang-testsUpgrade golangUpgrade golang-docsUpgrade golang-binUpgrade golang-raceUpgrade golang-misc | Mar 8, 2023 | Sep 6, 2022 |
| Redhat Openshift | — | Upgrade openshift-kuryrUpgrade openshift-clientsUpgrade skopeoUpgrade buildahUpgrade kernelUpgrade runcUpgrade podmanUpgrade atomic-openshift-service-idlerUpgrade ovn22.12Upgrade kernel-rtUpgrade containers-common | Jan 26, 2023 | Sep 6, 2022 |
| Suse | — | Upgrade go1.19Upgrade go1.19-docUpgrade go1.19-race | Oct 26, 2022 | Sep 13, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | Sep 13, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub