CVE-2023-45283
highpriority · track · 31EPSS 0.028 · 86 %ileDEEURUUSEPSS · scored 2026-10-27
The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (75)
Products and version ranges known to be affected.
advisories (8)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-2856Golang Go: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffDeutsch2023-11-07csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- WID-SEC-W-2023-3038Golang Go: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffDeutsch2023-11-30csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- WID-SEC-W-2025-0001IBM DB2: Mehrere SchwachstellenDeutsch2025-01-01csaf · cert_bundDE
Ein entfernter oder lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 on Cloud Pak for Data ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen.
- BIT-golang-2023-45283Insecure parsing of Windows paths with a \??\ prefix in path/filepath2024-03-06vendor · osvUS
The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.
- CGA-25c3-cp9r-6wrx2024-06-06vendor · osvUS
- CGA-qqfg-vr55-6p992024-06-06vendor · osvUS
- CGA-qqg8-j32g-67m92024-06-06vendor · osvUS
- GO-2023-2185Insecure parsing of Windows paths with a \??\ prefix in path/filepath2023-11-08vendor · osvUS
The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.
also known as (9)
Other names and identifiers for this entity.
- CNNVD-202311-775cnnvd
- EUVD-2023-49584enisa_euvd
- BDU:2023-09013fstec_bdu
- GHSA-vvjp-q62m-2vphenisa_euvd
- BIT-golang-2023-45283osv
- CGA-qqfg-vr55-6p99osv
- CGA-qqg8-j32g-67m9osv
- GHSA-vvjp-q62m-2vphosv
- GO-2023-2185osv
sources
Which sources assert this record, and when.
references (29)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2023/12/05/2cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-45283/cnnvd
- https://github.com/golang/go/releases/tag/go1.21.4Patchcnnvd
- https://go.dev/cl/540277cnnvd
- https://go.dev/cl/541175cnnvd
- https://go.dev/issue/63713cnnvd
- https://go.dev/issue/64028cnnvd
- https://groups.google.com/g/golang-announce/c/4tU8LZfBFkYcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan