GHSA-8v4j-7jgf-5rg9
Warp vulnerable to Path Traversal via Improper validation of Windows paths
Path resolution in warp::filters::fs::dir didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
What each source reports
GitHub AdvisoriesNo score
Warp vulnerable to Path Traversal via Improper validation of Windows paths
Path resolution in warp::filters::fs::dir didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
- Record
GHSA-8v4j-7jgf-5rg9- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVNo score
Warp vulnerable to Path Traversal via Improper validation of Windows paths
Path resolution in warp::filters::fs::dir didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
- Record
GHSA-8v4j-7jgf-5rg9- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVRUSTSEC-2022-0082No score
Improper validation of Windows paths could lead to directory traversal attack
Path resolution in warp::filters::fs::dir didn't correctly validate Windows paths
meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed
and respond with the contents of c:/windows/web/screen/img101.png. Thus users
could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
- Record
RUSTSEC-2022-0082- Updated
- 2026-11-02
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-8v4j-7jgf-5rg9 is a vulnerability with no CVSS score yet in warp, published January 14, 2022. No source lists public exploit code. Fixed in warp 0.3.3.