Path Traversal

2022-09-0809:54:21

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

path traversal

github.com/golang/go

joinpath vulnerability

url.go

file access

0.002 Low

EPSS

Percentile

53.3%

JSON

github.com/golang/go is vulnerable to path traversal. The vulnerability exists because the JoinPath function of url.go does not properly remove the relative elements from the start of the path when the first path element is “”, allowing an attacker to access files outside the expected directory through the urls such as https://go.dev", "../go

CPENameOperatorVersion
go:edgeeq1.18.5-r0
go:edgeeq1.16-r0
go:edgeeq1.16.2-r0
go:edgeeq1.17.3-r0
go:edgeeq1.18-r1
go:edgeeq1.18.3-r0
go:edgeeq1.18.3-r1
go:edgeeq1.17.8-r0
go:edgeeq1.16.4-r0
go:edgeeq1.16.5-r0

Name	Operator	Version
go:edge	eq	1.18.5-r0
go:edge	eq	1.16-r0
go:edge	eq	1.16.2-r0
go:edge	eq	1.17.3-r0
go:edge	eq	1.18-r1
go:edge	eq	1.18.3-r0
go:edge	eq	1.18.3-r1
go:edge	eq	1.17.8-r0
go:edge	eq	1.16.4-r0
go:edge	eq	1.16.5-r0