Insecure parsing of Windows paths with a \??\ prefix in path/filepath

CVE-2023-45283

What is CVE-2023-45283?

The filepath package in Go fails to handle paths with a ??\ prefix correctly, allowing access to arbitrary locations on Windows systems. Before the fix, paths such as ??\c:\x could be converted improperly, leading to potential security risks. The updates restore proper handling of these paths, ensuring that functions like Clean and Join do not inadvertently expose sensitive directories through incorrect path resolution.

References