title: Path traversal via Clean on Windows in path/filepath
description: Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.
problem types: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
vendor: Go standard library
product: path/filepath
collectionURL: https://pkg.go.dev
packageName: path/filepath
versions:
version: 0, lessThan: 1.17.11, status: affected, versionType: semver
version: 1.18.0-0, lessThan: 1.18.3, status: affected, versionType: semver
platforms: windows
programRoutines:
name: Clean
defaultStatus: unaffected
}