CVE-2022-41722

highpriority · track · 31EPSS 0.017 · 77 %ileDEEUNLUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
1.68% (77th) EPSS
CVSS 7.5 · high
Is it mine?
15 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · osv · cert_bund

EPSS · scored 2026-10-27

A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

01

cvss

Technical severity, 0–10. One row per scoring source.

7.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6
v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)
02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-22USprimaryCWE-22US
04

affected products (15)

Products and version ranges known to be affected.

05

advisories (7)

Vendor and ecosystem advisories describing this.

  • NCSC-2024-0339Kwetsbaarheden verholpen in Microsoft MarinerNL2024-08-13csaf · ncsc_nlNL

    Microsoft heeft kwetsbaarheden verholpen in Mariner (Azure Linux).

  • WID-SEC-W-2023-1354Red Hat OpenShift Container Platform: Mehrere SchwachstellenDeutsch2023-06-04csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Container Platform ausnutzen, um einen Denial of Service Angriff durchzuführen oder Informationen offenzulegen.

  • WID-SEC-W-2023-1378Red Hat OpenShift Container Platform: Mehrere Schwachstellen ermöglichen Umgehen von SicherheitsvorkehrungenDeutsch2023-06-06csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in der Red Hat OpenShift Container Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

  • WID-SEC-W-2023-2031Xerox FreeFlow Print Server: Mehrere SchwachstellenDeutsch2023-08-09csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.

  • WID-SEC-W-2023-2229Splunk Splunk Enterprise: Mehrere SchwachstellenDeutsch2023-08-30csaf · cert_bundDE

    Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um beliebigen Code auszuführen, einen 'Denial of Service'-Zustand zu verursachen, seine Privilegien zu erweitern und weitere, nicht spezifizierte Auswirkungen zu verursachen.

  • BIT-golang-2022-41722Path traversal on Windows in path/filepath2024-03-06vendor · osvUS

    A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

  • GO-2023-1568Path traversal on Windows in path/filepath2023-02-16vendor · osvUS

    A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

06

also known as (5)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdosvcert_bundnvdncsc_nlNVDCVE.orgMITRE
published 2023-02-28modified 2026-06-17
09

references (17)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan