Path traversal on Windows in path/filepath

CVE-2022-41722

What is CVE-2022-41722?

A path traversal vulnerability exists in the filepath.Clean function on Windows platforms. This function improperly validates paths, allowing potentially malicious input to be transformed into accessible absolute paths. Specifically, it can convert an invalid path such as 'a/../c:/b' into 'c:\b', facilitating unauthorized access to directories. Post-fix improvements ensure that invalid paths are not converted into absolute paths, hence mitigating the risk of such directory traversal attacks.

References