title: Path traversal on Windows in path/filepath
description: A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".
problem types: CWE-22: Improper Limitation of a Pathname to a Restricted
Directory ("Path Traversal")
affected:
{
vendor: Go standard library
product: path/filepath
collectionURL: https://pkg.go.dev
packageName: path/filepath
versions:
version: 0, lessThan: 1.19.6, status: affected, versionType: semver
version: 1.20.0-0, lessThan: 1.20.1, status: affected, versionType: semver
platforms: windows
programRoutines:
name: Clean
name: Abs
name: Dir
name: EvalSymlinks
name: Glob
name: IsLocal
name: Join
name: Rel
name: Walk
name: WalkDir
defaultStatus: unaffected
}