CVE-2022-41722

golang: path/filepath: path-filepath filepath.Clean path traversal

Loading…

Severity

Moderate

Red Hat Product Security

7.5

CVSS 3.1

Review impact separately from score.

Published · February 15, 2023

Updated · November 1, 2026

Description

A flaw was found in Go, where it could allow a remote attacker to traverse directories on the system, caused by improper validation of user requests by the filepath.Clean on Windows package. This flaw allows an attacker to send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Statement

This CVE is specific to versions of Go on Windows. It does not affect any packages shipped with Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9.

The following components were fixed in RHSA-2023:3366 and have therefore been marked as "Not Affected": openshift, cri-tools, cri-o, containernetworking-plugins and conmon

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-22 · Improper Limitation of a Pathname to a Restricted Directory