CVE-2022-32190

HIGH7.5EPSS 0.08%

Failure to strip relative path components in net/url

Published: 9/12/2022Modified: 4/28/2026

Description

JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.

Affected packages (3)

Bitnami/golang>= 1.19.0-0, < 1.19.1
Debian/golang-1.19from 0, < 1.19.1-1
Go/stdlib>= 1.19.0-0, < 1.19.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (6)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2022-32190
PATCHhttps://go.dev/cl/423514
REPORThttps://go.dev/issue/54385
WEBhttps://groups.google.com/g/golang-announce/c/x49AQzIVX-s
WEBhttps://nvd.nist.gov/vuln/detail/CVE-2022-32190
WEBhttps://pkg.go.dev/vuln/GO-2022-0988