CVE-2022-32190

Failure to strip relative path components in net/url

Published Sep 13, 2022 CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Description
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-53402 JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00081}

epss

{'score': 0.00143}