https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 08:29:06 +0000 https://vulnerability.circl.lu/vuln/ghsa-6xv5-86q9-7xr8 <p><strong>Affected:</strong> Go: github.com/cyphar/filepath-securejoin</p> <p>### Impact For Windows users of `github.com/cyphar/filepath-securejoin`, until v0.2.4 it was possible for certain rootfs and path combinations (in particular, where a malicious Unix-style `/`-separated unsafe path was used with a Windows-style rootfs path) to result in generated paths that were outside of the provided rootfs.</p> <p>It is unclear to what extent this has a practical impact on real users, but given the possible severity of the issue we have released an emergency patch release that resolves this issue.</p> <p>Thanks to @pjbgf for discovering, debugging, and fixing this issue (as well as writing some tests for it).</p> <p>### Patches c121231e1276e11049547bee5ce68d5a2cfe2d9b is the patch fixing this issue. v0.2.4 contains the fix.</p> <p>### Workarounds Users could use `filepath.FromSlash()` on all unsafe paths before passing them to `filepath-securejoin`.</p> <p>### References See #9.</p> <p><strong>Affected:</strong> Go: github.com/cyphar/filepath-securejoin</p> <p>### Impact For Windows users of `github.com/cyphar/filepath-securejoin`, until v0.2.4 it was possible for certain rootfs and path combinations (in particular, where a malicious Unix-style `/`-separated unsafe path was used with a Windows-style rootfs path) to result in generated paths that were outside of the provided rootfs.</p> <p>It is unclear to what extent this has a practical impact on real users, but given the possible severity of the issue we have released an emergency patch release that resolves this issue.</p> <p>Thanks to @pjbgf for discovering, debugging, and fixing this issue (as well as writing some tests for it).</p> <p>### Patches c121231e1276e11049547bee5ce68d5a2cfe2d9b is the patch fixing this issue. v0.2.4 contains the fix.</p> <p>### Workarounds Users could use `filepath.FromSlash()` on all unsafe paths before passing them to `filepath-securejoin`.</p> <p>### References See #9.</p> https://vulnerability.circl.lu/vuln/ghsa-6xv5-86q9-7xr8