{"id":"GHSA-6xv5-86q9-7xr8","aliases":["GO-2023-2048"],"title":"SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced","summary":"SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced","severity":"medium","vendor":"cyphar","product":"github.com/cyphar/filepath-securejoin","ecosystem":"go","affected":["github.com/cyphar/filepath-securejoin < 0.2.4"],"patched":["github.com/cyphar/filepath-securejoin 0.2.4"],"published":"2023-09-07","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:57.965917829Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6xv5-86q9-7xr8","references":[{"url":"https://github.com/cyphar/filepath-securejoin/security/advisories/GHSA-6xv5-86q9-7xr8"},{"url":"https://github.com/cyphar/filepath-securejoin/pull/9"},{"url":"https://github.com/cyphar/filepath-securejoin/commit/c121231e1276e11049547bee5ce68d5a2cfe2d9b"},{"url":"https://github.com/cyphar/filepath-securejoin"},{"url":"https://github.com/cyphar/filepath-securejoin/releases/tag/v0.2.4"}],"tags":["osv","go"],"ingestedAt":"2026-09-12T03:13:01.761Z","slug":"GHSA-6xv5-86q9-7xr8","body":"## Overview\n\n### Impact\nFor Windows users of `github.com/cyphar/filepath-securejoin`, until v0.2.4 it was possible for certain rootfs and path combinations (in particular, where a malicious Unix-style `/`-separated unsafe path was used with a Windows-style rootfs path) to result in generated paths that were outside of the provided rootfs.\n\nIt is unclear to what extent this has a practical impact on real users, but given the possible severity of the issue we have released an emergency patch release that resolves this issue.\n\nThanks to  @pjbgf for discovering, debugging, and fixing this issue (as well as writing some tests for it).\n\n### Patches\nc121231e1276e11049547bee5ce68d5a2cfe2d9b is the patch fixing this issue. v0.2.4 contains the fix.\n\n### Workarounds\nUsers could use `filepath.FromSlash()` on all unsafe paths before passing them to `filepath-securejoin`.\n\n### References\nSee #9.\n\n## Affected packages\n\n- `github.com/cyphar/filepath-securejoin < 0.2.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/cyphar/filepath-securejoin 0.2.4`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}