| modules: |
| - module: std |
| versions: |
| - introduced: 1.19.0 |
| fixed: 1.19.1 |
| vulnerable_at: 1.19.0 |
| packages: |
| - package: net/url |
| symbols: |
| - URL.JoinPath |
| derived_symbols: |
| - JoinPath |
| description: | |
| JoinPath and URL.JoinPath do not remove ../ path elements appended |
| to a relative path. For example, JoinPath("https://go.dev", "../go") |
| returns the URL "https://go.dev/../go", despite the JoinPath documentation |
| stating that ../ path elements are removed from the result. |
| published: 2022-09-12T20:23:15Z |
| credit: '@q0jt' |
| references: |
| - web: https://groups.google.com/g/golang-announce/c/x49AQzIVX-s |
| - report: https://go.dev/issue/54385 |
| - fix: https://go.dev/cl/423514 |
| cve_metadata: |
| id: CVE-2022-32190 |
| cwe: 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path |
| Traversal'')' |
