CVE-2022-41722: Path Traversal Vulnerability in stdlib package
Summary
CVE-2022-41722: Path traversal on Windows in path/filepath. Affects stdlib across 2 version ranges.
< 1.19.6
>= 1.20.0-0, < 1.20.1
Fixed in 1.19.6 or 1.20.1, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2022-41722 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The stdlib package is a part of the Go ecosystem and provides a collection of standard libraries for various functionalities. It includes the path/filepath package, which offers functions for manipulating file paths. This vulnerability specifically affects the filepath.Clean function on Windows.
Vulnerability Detail
A path traversal vulnerability exists in the filepath.Clean function on Windows. The function could transform an invalid path, such as "a/../c:/b", into a valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After the fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.19.61.19.6go get stdlib@v1.19.6 -
>= 1.20.0-0, < 1.20.11.20.1go get stdlib@v1.20.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, developers can mitigate the risk by validating and sanitizing user input when dealing with file paths. Implementing strict input validation and only allowing known safe paths can help prevent path traversal attacks.
Conclusion
The path traversal vulnerability in the filepath.Clean function of the stdlib package on Windows can be mitigated by updating the Go version to 1.19.6 or 1.20.1, or any subsequent version. It is important to validate and sanitize user input when dealing with file paths to prevent path traversal attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
This vulnerability could allow an attacker to access files and directories outside of the intended scope, potentially leading to unauthorized access, data leakage, or remote code execution.
The vulnerability affects versions 0.0.0 to 1.19.5 and 1.20.0-0 of the stdlib package.
No, this vulnerability specifically affects the filepath.Clean function on Windows.
There are no known public exploits for this vulnerability at the time of this report.
Updating the Go version is the recommended solution. However, developers can also implement strict input validation and sanitization to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
