---
id: GHSA-6xv5-86q9-7xr8
aliases:
  - GO-2023-2048
title: >-
  SecureJoin: on windows, paths outside of the rootfs could be inadvertently
  produced
summary: >-
  SecureJoin: on windows, paths outside of the rootfs could be inadvertently
  produced
severity: medium
vendor: cyphar
product: github.com/cyphar/filepath-securejoin
ecosystem: go
affected:
  - github.com/cyphar/filepath-securejoin < 0.2.4
patched:
  - github.com/cyphar/filepath-securejoin 0.2.4
published: '2023-09-07'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:57.965917829Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-6xv5-86q9-7xr8'
references:
  - url: >-
      https://github.com/cyphar/filepath-securejoin/security/advisories/GHSA-6xv5-86q9-7xr8
  - url: 'https://github.com/cyphar/filepath-securejoin/pull/9'
  - url: >-
      https://github.com/cyphar/filepath-securejoin/commit/c121231e1276e11049547bee5ce68d5a2cfe2d9b
  - url: 'https://github.com/cyphar/filepath-securejoin'
  - url: 'https://github.com/cyphar/filepath-securejoin/releases/tag/v0.2.4'
tags:
  - osv
  - go
ingestedAt: '2026-09-12T03:13:01.761Z'
---

## Overview

### Impact
For Windows users of `github.com/cyphar/filepath-securejoin`, until v0.2.4 it was possible for certain rootfs and path combinations (in particular, where a malicious Unix-style `/`-separated unsafe path was used with a Windows-style rootfs path) to result in generated paths that were outside of the provided rootfs.

It is unclear to what extent this has a practical impact on real users, but given the possible severity of the issue we have released an emergency patch release that resolves this issue.

Thanks to  @pjbgf for discovering, debugging, and fixing this issue (as well as writing some tests for it).

### Patches
c121231e1276e11049547bee5ce68d5a2cfe2d9b is the patch fixing this issue. v0.2.4 contains the fix.

### Workarounds
Users could use `filepath.FromSlash()` on all unsafe paths before passing them to `filepath-securejoin`.

### References
See #9.

## Affected packages

- `github.com/cyphar/filepath-securejoin < 0.2.4`

## Remediation

Upgrade to a patched release:

- `github.com/cyphar/filepath-securejoin 0.2.4`