path/filepath vulnerabilities
4 known vulnerabilities in path/filepath from Go standard library. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
path/filepath: Improper Limitation of a Pathname to a Restricted Directory
The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the
- 7.5 High severity
path/filepath: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute pat
- 7.5 High severity
path/filepath: Uncontrolled Recursion
Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.
- 7.5 High severity
path/filepath: Improper Limitation of a Pathname to a Restricted Directory
Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.