CVE-2023-45283

The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.

• CWE-22

• http://www.openwall.com/lists/oss-security/2023/12/05/2
• https://go.dev/cl/540277Issue Tracking, Vendor Advisory
• https://go.dev/cl/541175
• https://go.dev/issue/63713Issue Tracking, Vendor Advisory
• https://go.dev/issue/64028
• https://groups.google.com/g/golang-announce/c/4tU8LZfBFkYIssue Tracking, Mailing List, Vendor Advisory
• https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
• https://pkg.go.dev/vuln/GO-2023-2185Issue Tracking, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20231214-0008/
• http://www.openwall.com/lists/oss-security/2023/12/05/2
• https://go.dev/cl/540277Issue Tracking, Vendor Advisory
• https://go.dev/cl/541175
• https://go.dev/issue/63713Issue Tracking, Vendor Advisory
• https://go.dev/issue/64028
• https://groups.google.com/g/golang-announce/c/4tU8LZfBFkYIssue Tracking, Mailing List, Vendor Advisory
• https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
• https://pkg.go.dev/vuln/GO-2023-2185Issue Tracking, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20231214-0008/

Published

Nov 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45278Directory Traversal vulnerability in the storage functionali…9.1
• CVE-2023-45279Yamcs 5.8.6 allows XSS (issue 1 of 2). It comes with a Bucke…5.4
• CVE-2023-4528Unsafe deserialization in JSCAPE MFT Server versions prior t…7.2
• CVE-2023-45280Yamcs 5.8.6 allows XSS (issue 2 of 2). It comes with a Bucke…5.4
• CVE-2023-45281An issue in Yamcs 5.8.6 allows attackers to obtain the sessi…6.1
• CVE-2023-45282In NASA Open MCT (aka openmct) before 3.1.0, prototype pollu…7.5
• CVE-2023-45284On Windows, The IsLocal function does not correctly detect r…5.3
• CVE-2023-45285Using go get to fetch a module with the ".git" suffix may un…7.5
• CVE-2023-45286A race condition in go-resty can result in HTTP request body…5.9
• CVE-2023-45287Before Go 1.20, the RSA based TLS key exchanges used the mat…7.5
• CVE-2023-45288An attacker may cause an HTTP/2 endpoint to read arbitrary a…7.5
• CVE-2023-45289When following an HTTP redirect to a domain which is not a s…4.3