-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of Windows volume names in path joining logic. The original implementation in SecureJoinVFS did not strip volume names from 'unsafePath' (via filepath.VolumeName), enabling scenarios where a malicious path like 'D:\malicious' combined with a rootfs 'C:\safe' could resolve outside the rootfs. The patch explicitly adds volume name stripping, confirming this was the vulnerable code path.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/cyphar/filepath-securejoin | go | < 0.2.4 | 0.2.4 |
GoGoOngoing coverage of React2Shell