reports/GO-2022-0533.yaml

packages:
  - module: std
    package: path/filepath
    symbols:
      - Clean
    versions:
      - fixed: 1.17.11
      - introduced: 1.18.0
        fixed: 1.18.3
    vulnerable_at: 1.18.2
description: |
    On Windows, the filepath.Clean function can convert certain invalid paths
    to valid, absolute paths, potentially allowing a directory traversal
    attack.

    For example, Clean(`.\c:`) returns `c:`.
credit: Unrud
os:
  - windows
links:
    pr: https://go.dev/cl/401595
    commit: https://go.googlesource.com/go/+/9cd1818a7d019c02fa4898b3e45a323e35033290
    context:
      - https://go.dev/issue/52476
      - https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ
cve_metadata:
    id: CVE-2022-29804
    cwe: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
    description: |
        Incorrect conversion of certain invalid paths to valid, absolute paths
        in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows
        allows potential directory traversal attack.