CVE-2022-32190

JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.

• CWE-22

• https://go.dev/cl/423514Patch, Release Notes
• https://go.dev/issue/54385Issue Tracking, Patch, Vendor Advisory
• https://groups.google.com/g/golang-announce/c/x49AQzIVX-sMailing List, Third Party Advisory
• https://pkg.go.dev/vuln/GO-2022-0988Issue Tracking, Patch, Vendor Advisory
• https://go.dev/cl/423514Patch, Release Notes
• https://go.dev/issue/54385Issue Tracking, Patch, Vendor Advisory
• https://groups.google.com/g/golang-announce/c/x49AQzIVX-sMailing List, Third Party Advisory
• https://pkg.go.dev/vuln/GO-2022-0988Issue Tracking, Patch, Vendor Advisory

Published

Sep 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-32175In AdGuardHome, versions v0.95 through v0.108.0-b.13 are vul…5.4
• CVE-2022-32176In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vuln…9
• CVE-2022-32177In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are v…9
• CVE-2022-3218Due to a reliance on client-side authentication, the WiFi Mo…9.8
• CVE-2022-32189A too-short encoded message can cause a panic in Float.GobDe…7.5
• CVE-2022-3219GnuPG can be made to spin on a relatively small input by (fo…3.3
• CVE-2022-32191Rejected reason: reserved but not needed
• CVE-2022-32192Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensit…7.5
• CVE-2022-32193Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sens…6.5
• CVE-2022-32195Open edX platform before 2022-06-06 allows XSS via the "next…6.1
• CVE-2022-32199db_convert.php in ScriptCase through 9.9.008 is vulnerable t…6.5
• CVE-2022-3220The Advanced Comment Form WordPress plugin before 1.2.1 does…4.8