CVE-2022-29804: vulnerability in Go standard library path/filepath
Path traversal via Clean on Windows in path/filepath
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 2.4%
Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.
Affected products
Go standard library · path/filepathRelated CVEs — Go standard library path/filepath
In the same product, most dangerous first.
CVE-2023-45283—Insecure parsing of Windows paths with a \??\ prefix in path/filepathEPSS 3.3%CVE-2022-30632—Stack exhaustion on crafted paths in path/filepathEPSS 2.2%CVE-2022-41722—Path traversal on Windows in path/filepathEPSS 1.7%CVE-2023-45284MEDIUMIncorrect detection of reserved device names on Windows in path/filepathEPSS 1.1%CVE-2024-8244LOWWalk/WalkDir in path/filepath susceptible to symlink raceEPSS 0.2%