CVE-2022-41720
highpriority · track · 30EPSS 0.013 · 70 %ileDEEUUSEPSS · scored 2026-10-27
On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS("C:/tmp").Open("COM1") opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system. With fix applied, the behavior of os.DirFS("") has changed. Previously, an empty root was treated equivalently to "/", so os.DirFS("").Open("tmp") would open the path "/tmp". This now returns an error.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (17)
Products and version ranges known to be affected.
- Xerox FreeFlow Print Server v7 for Solarisall versionscert_bundDEcpe:/a:xerox:freeflow_print_server:v7_for_solaris
advisories (6)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-0138Oracle Communications Applications: Mehrere SchwachstellenDeutsch2023-01-17csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-1350Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von DrittanbieternDeutsch2023-06-01csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise in diversen Komponenten von Drittanbietern ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- WID-SEC-W-2023-2031Xerox FreeFlow Print Server: Mehrere SchwachstellenDeutsch2023-08-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.
- WID-SEC-W-2023-2229Splunk Splunk Enterprise: Mehrere SchwachstellenDeutsch2023-08-30csaf · cert_bundDE
Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um beliebigen Code auszuführen, einen 'Denial of Service'-Zustand zu verursachen, seine Privilegien zu erweitern und weitere, nicht spezifizierte Auswirkungen zu verursachen.
- BIT-golang-2022-41720Restricted file access on Windows in os and net/http2024-03-06vendor · osvUS
On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS("C:/tmp").Open("COM1") opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system. With fix applied, the behavior of os.DirFS("") has changed. Previously, an empty root was treated equivalently to "/", so os.DirFS("").Open("tmp") would open the path "/tmp". This now returns an error.
- GO-2022-1143Restricted file access on Windows in os and net/http2022-12-07vendor · osvUS
On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS("C:/tmp").Open("COM1") opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system. With fix applied, the behavior of os.DirFS("") has changed. Previously, an empty root was treated equivalently to "/", so os.DirFS("").Open("tmp") would open the path "/tmp". This now returns an error.
also known as (5)
Other names and identifiers for this entity.
- CNNVD-202212-2649cnnvd
- EUVD-2022-44894enisa_euvd
- GHSA-cvf9-g74c-vv79enisa_euvd
- BIT-golang-2022-41720osv
- GO-2022-1143osv
sources
Which sources assert this record, and when.
references (17)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2022-41720/cnnvd
- https://go.dev/cl/455716cnnvd
- https://go.dev/issue/56694cnnvd
- https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJcnnvd
- https://pkg.go.dev/vuln/GO-2022-1143cnnvd
- https://vigilance.fr/vulnerability/Go-file-reading-via-os-DirFS-cnnvd
- https://www.auscert.org.au/bulletins/ESB-2022.6443cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.3111cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan