CVE-2022-30636

httpTokenCacheKey uses path.Base to extract the expected HTTP-01 token value to lookup in the DirCache implementation. On Windows, path.Base acts differently to filepath.Base, since Windows uses a different path separator (\ vs. /), allowing a user to provide a relative path, i.e. .well-known/acme-challenge/..\..\asd becomes ..\..\asd. The extracted path is then suffixed with +http-01, joined with the cache directory, and opened. Since the controlled path is suffixed with +http-01 before opening, the impact of this is significantly limited, since it only allows reading arbitrary files on the system if and only if they have this suffix.

• https://go.dev/cl/408694
• https://go.dev/issue/53082
• https://pkg.go.dev/vuln/GO-2024-2961
• https://go.dev/cl/408694
• https://go.dev/issue/53082
• https://pkg.go.dev/vuln/GO-2024-2961

Published

Jul 2, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30630Uncontrolled recursion in Glob in io/fs before Go 1.17.12 an…7.5
• CVE-2022-30631Uncontrolled recursion in Reader.Read in compress/gzip befor…7.5
• CVE-2022-30632Uncontrolled recursion in Glob in path/filepath before Go 1.…7.5
• CVE-2022-30633Uncontrolled recursion in Unmarshal in encoding/xml before G…7.5
• CVE-2022-30634Infinite loop in Read in crypto/rand before Go 1.17.11 and G…7.5
• CVE-2022-30635Uncontrolled recursion in Decoder.Decode in encoding/gob bef…7.5
• CVE-2022-30637Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (…7.8
• CVE-2022-30638Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (…7.8
• CVE-2022-30639Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (…7.8
• CVE-2022-3064Parsing malicious or large YAML documents can consume excess…7.5
• CVE-2022-30640Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (…7.8
• CVE-2022-30641Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (…7.8