https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 07:18:45 +0000 https://vulnerability.circl.lu/vuln/cve-2022-41720 <p><strong>Affected:</strong> Go standard library os, Go standard library net/http</p> <p>On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS(&#34;C:/tmp&#34;).Open(&#34;COM1&#34;) opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system. With fix applied, the behavior of os.DirFS(&#34;&#34;) has changed. Previously, an empty root was treated equivalently to &#34;/&#34;, so os.DirFS(&#34;&#34;).Open(&#34;tmp&#34;) would open the path &#34;/tmp&#34;. This now returns an error.</p> <p><strong>Affected:</strong> Go standard library os, Go standard library net/http</p> <p>On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS(&#34;C:/tmp&#34;).Open(&#34;COM1&#34;) opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system. With fix applied, the behavior of os.DirFS(&#34;&#34;) has changed. Previously, an empty root was treated equivalently to &#34;/&#34;, so os.DirFS(&#34;&#34;).Open(&#34;tmp&#34;) would open the path &#34;/tmp&#34;. This now returns an error.</p> https://vulnerability.circl.lu/vuln/cve-2022-41720