Skip to main content
cve.nowby Sazabi
← Go
GoPackage

path/filepath

6 known vulnerabilities (1 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 1 medium, 1 low
Registry
pkg.go.dev

Advisories 6

  • Walk/WalkDir in path/filepath susceptible to symlink race

    Affected: version range not reported.

  • CVE-2023-45284Medium 5.3

    Incorrect detection of reserved device names on Windows in path/filepath

    Affected: fixed in 1.20.11; from 1.21.0-0, fixed in 1.21.4.

  • Insecure parsing of Windows paths with a \??\ prefix in path/filepath

    Affected: fixed in 1.20.11; from 1.21.0-0, fixed in 1.21.4; from 1.20.11, fixed in 1.20.12; from 1.21.4, fixed in 1.21.5.

  • Path traversal on Windows in path/filepath

    Affected: fixed in 1.19.6; from 1.20.0-0, fixed in 1.20.1.

  • Stack exhaustion on crafted paths in path/filepath

    Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.

  • Path traversal via Clean on Windows in path/filepath

    Affected: fixed in 1.17.11; from 1.18.0-0, fixed in 1.18.3.