CVE-2022-41722

A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

• CWE-22

• https://go.dev/cl/468123Issue Tracking
• https://go.dev/issue/57274Issue Tracking
• https://groups.google.com/g/golang-announce/c/V0aBFqaFs_EMailing List, Vendor Advisory
• https://pkg.go.dev/vuln/GO-2023-1568Vendor Advisory
• https://go.dev/cl/468123Issue Tracking
• https://go.dev/issue/57274Issue Tracking
• https://groups.google.com/g/golang-announce/c/V0aBFqaFs_EMailing List, Vendor Advisory
• https://pkg.go.dev/vuln/GO-2023-1568Vendor Advisory

Published

Feb 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-41717An attacker can cause excessive memory growth in a Go server…5.3
• CVE-2022-41718Rejected reason: reserved but not needed
• CVE-2022-41719Unmarshal can panic on some inputs, possibly allowing for de…7.5
• CVE-2022-4172An integer overflow and buffer overflow issues were found in…6.5
• CVE-2022-41720On Windows, restricted files can be accessed via os.DirFS an…7.5
• CVE-2022-41721A request smuggling attack is possible when using MaxBytesHa…7.5
• CVE-2022-41723A maliciously crafted HTTP/2 stream could cause excessive CP…7.5
• CVE-2022-41724Large handshake records may cause panics in crypto/tls. Both…7.5
• CVE-2022-41725A denial of service is possible from excessive resource cons…7.5
• CVE-2022-41726Rejected reason: reserved but not needed
• CVE-2022-41727An attacker can craft a malformed TIFF image which will cons…5.5
• CVE-2022-41728Rejected reason: reserved but not needed