HIGH7.5
GO-2023-1568
Path traversal on Windows in path/filepath
Quick fix
GO-2023-1568 — stdlib: upgrade to the fixed version with the command below.
go get stdlib@v1.19.6Details
A path traversal vulnerability exists in filepath.Clean on Windows.
On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack.
After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".
Are you affected?
Enter the version of the package you're using.