CVE-2022-32190

Failure to strip relative path components in net/url

published September 13, 2022

CVSS
—
EPSS
2%
Percentile
82.0
In the wild
Unconfirmed
What it is

JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02152 · 82.0th percentile
Published
2022-09-13T17:08Z
EPSS history
Timeline
  • 13 SEP 17:08Z
    Failure to strip relative path components in net/url
    cvelistv5