CVE-2022-41720: Restricted file access on Windows in stdlib
Summary
CVE-2022-41720: Restricted file access on Windows in os and net/http. Affects stdlib across 2 version ranges.
< 1.18.9
>= 1.19.0-0, < 1.19.4
Fixed in 1.18.9 or 1.19.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2022-41720 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go is a collection of standard libraries that provide fundamental functionality for Go programs. It includes various modules for file system operations, networking, and more. This vulnerability specifically affects the os and net/http modules on Windows systems.
Vulnerability Detail
On Windows, the os.DirFS function and http.Dir type in the stdlib package allow access to a tree of files rooted at a specified directory. However, this functionality can be exploited to access restricted files, including Windows device files. Additionally, an os.DirFS for the root directory can be manipulated to escape the drive and access any path on the system. This vulnerability can potentially lead to unauthorized access to sensitive files and system compromise.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.18.91.18.9go get stdlib@v1.18.9 -
>= 1.19.0-0, < 1.19.41.19.4go get stdlib@v1.19.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to the latest version is not immediately possible, a workaround can be implemented by avoiding the usage of os.DirFS and http.Dir functions on Windows systems. Instead, alternative methods for file system access should be used, ensuring proper security measures are in place to prevent unauthorized access.
Conclusion
The CVE-2022-41720 vulnerability in the Go stdlib package on Windows systems allows for restricted file access and potential system compromise. It is crucial to update to the latest version of the package to mitigate this vulnerability. If immediate update is not possible, alternative methods should be used to avoid the affected functions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
This vulnerability allows an attacker to access restricted files and potentially escape the drive to access any path on the system. It can lead to unauthorized access to sensitive information and compromise the integrity of the system.
Versions 0.0.0 to 1.18.8 and 1.19.0 to 1.19.3 of the Go stdlib package on Windows systems are affected by this vulnerability.
No, this vulnerability specifically affects Windows systems. Linux and macOS systems are not impacted.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to apply the recommended fix to mitigate any potential risks.
No, this vulnerability requires local access to the system. It cannot be exploited remotely over a network.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
