{"id":"GHSA-6xv5-86q9-7xr8","aliases":["GO-2023-2048"],"status":"published","title":"SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced","description":"### Impact\nFor Windows users of `github.com/cyphar/filepath-securejoin`, until v0.2.4 it was possible for certain rootfs and path combinations (in particular, where a malicious Unix-style `/`-separated unsafe path was used with a Windows-style rootfs path) to result in generated paths that were outside of the provided rootfs.\n\nIt is unclear to what extent this has a practical impact on real users, but given the possible severity of the issue we have released an emergency patch release that resolves this issue.\n\nThanks to  @pjbgf for discovering, debugging, and fixing this issue (as well as writing some tests for it).\n\n### Patches\nc121231e1276e11049547bee5ce68d5a2cfe2d9b is the patch fixing this issue. v0.2.4 contains the fix.\n\n### Workarounds\nUsers could use `filepath.FromSlash()` on all unsafe paths before passing them to `filepath-securejoin`.\n\n### References\nSee #9.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-09-07T12:58:58Z","modified":"2026-09-10T03:49:57Z","fixes":[{"ecosystem":"Go","package":"github.com/cyphar/filepath-securejoin","fixed_in":["0.2.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/cyphar/filepath-securejoin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cyphar/filepath-securejoin","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cyphar/filepath-securejoin","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.4"}]}]}],"references":[{"url":"https://github.com/cyphar/filepath-securejoin/security/advisories/GHSA-6xv5-86q9-7xr8","tags":["web","advisory"]},{"url":"https://github.com/cyphar/filepath-securejoin/pull/9","tags":["web"]},{"url":"https://github.com/cyphar/filepath-securejoin/commit/c121231e1276e11049547bee5ce68d5a2cfe2d9b","tags":["web","fix"]},{"url":"https://github.com/cyphar/filepath-securejoin/releases/tag/v0.2.4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6xv5-86q9-7xr8"},{"url":"https://github.com/cyphar/filepath-securejoin","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-6xv5-86q9-7xr8","title":"SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced","description":"### Impact\nFor Windows users of `github.com/cyphar/filepath-securejoin`, until v0.2.4 it was possible for certain rootfs and path combinations (in particular, where a malicious Unix-style `/`-separated unsafe path was used with a Windows-style rootfs path) to result in generated paths that were outside of the provided rootfs.\n\nIt is unclear to what extent this has a practical impact on real users, but given the possible severity of the issue we have released an emergency patch release that resolves this issue.\n\nThanks to  @pjbgf for discovering, debugging, and fixing this issue (as well as writing some tests for it).\n\n### Patches\nc121231e1276e11049547bee5ce68d5a2cfe2d9b is the patch fixing this issue. v0.2.4 contains the fix.\n\n### Workarounds\nUsers could use `filepath.FromSlash()` on all unsafe paths before passing them to `filepath-securejoin`.\n\n### References\nSee #9.","status":"published","published":"2023-09-07T12:58:58Z","modified":"2023-09-07T12:58:58Z","updated_at":"2026-11-02T14:37:02.632342Z"}],"osv":[{"id":"GHSA-6xv5-86q9-7xr8","title":"SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced","description":"### Impact\nFor Windows users of `github.com/cyphar/filepath-securejoin`, until v0.2.4 it was possible for certain rootfs and path combinations (in particular, where a malicious Unix-style `/`-separated unsafe path was used with a Windows-style rootfs path) to result in generated paths that were outside of the provided rootfs.\n\nIt is unclear to what extent this has a practical impact on real users, but given the possible severity of the issue we have released an emergency patch release that resolves this issue.\n\nThanks to  @pjbgf for discovering, debugging, and fixing this issue (as well as writing some tests for it).\n\n### Patches\nc121231e1276e11049547bee5ce68d5a2cfe2d9b is the patch fixing this issue. v0.2.4 contains the fix.\n\n### Workarounds\nUsers could use `filepath.FromSlash()` on all unsafe paths before passing them to `filepath-securejoin`.\n\n### References\nSee #9.","status":"published","published":"2023-09-07T12:58:58Z","modified":"2026-09-10T03:49:57.965917829Z","updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"GO-2023-2048","title":"Paths outside of the rootfs could be produced on Windows in github.com/cyphar/filepath-securejoin","description":"Certain rootfs and path combinations result in generated paths that are outside of the provided rootfs on Windows.","status":"published","published":"2023-09-13T19:45:03Z","modified":"2026-02-04T04:10:21.741884Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}