HIGH7.5
GO-2022-0533
Path traversal via Clean on Windows in path/filepath
Quick fix
GO-2022-0533 — stdlib: upgrade to the fixed version with the command below.
go get stdlib@v1.17.11Details
On Windows, the filepath.Clean function can convert certain invalid paths to valid, absolute paths, potentially allowing a directory traversal attack.
For example, Clean(".\c:") returns "c:".
Are you affected?
Enter the version of the package you're using.