A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Feb 28, 2023 |
| Amazon Linux Ami 2 | — | Upgrade golang-miscUpgrade golang-raceUpgrade golang-docsUpgrade golangUpgrade golang-binUpgrade golang-testsUpgrade golang-srcUpgrade golang-shared | Apr 21, 2023 | Feb 28, 2023 |
| Amazon_linux | — | Upgrade golang | Apr 21, 2023 | Feb 14, 2023 |
| Amazon_linux_2023 | — | Upgrade golangUpgrade golang-miscUpgrade golang-docsUpgrade golang-srcUpgrade golang-raceUpgrade golang-sharedUpgrade golang-binUpgrade golang-tests | Feb 17, 2025 | Feb 15, 2023 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Feb 28, 2023 |
| Freebsd | — | Upgrade go119Upgrade go120 | Feb 17, 2023 | Feb 15, 2023 |
| Redhat Openshift | — | Upgrade openshift-clientsUpgrade cri-toolsUpgrade openshiftUpgrade cri-o | Jun 8, 2023 | Feb 15, 2023 |
| Suse | — | Upgrade go1.19-raceUpgrade go1.20-docUpgrade go1.19Upgrade go1.20Upgrade go1.19-docUpgrade go1.20-race | Mar 15, 2023 | Feb 28, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 28, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub