TI-2023-24273 Aliases CVE-2023-45283 GHSA-vvjp-q62m-2vph

Insecure parsing of Windows paths with a \??\ prefix in path/filepath

LOW 39CWE-22Published 2023-11-09 · Updated 2025-02-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.

Why it matters now

EPSS 0.03316 88th percentileScored 2026-11-07

Fix Fixed path/filepath (Go standard library): 1.20.11, 1.21.4, 1.20.12 +1internal/safefilepath (Go standard library): 1.20.11, 1.21.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Go standard library	path/filepath	before 1.20.11; 1.21.0-0 to before 1.21.4	1.20.11, 1.21.4	Patch available	CNA
Go standard library	internal/safefilepath	before 1.20.11; 1.21.0-0 to before 1.21.4	1.20.11, 1.21.4	Patch available	CNA
Go standard library	path/filepath	1.20.11 to before 1.20.12; 1.21.4 to before 1.21.5	1.20.12, 1.21.5	Patch available	CNA

path/filepath VendorGo standard library Affected before 1.20.11; 1.21.0-0 to before 1.21.4 Fixed in 1.20.11, 1.21.4 Patch available CNA
internal/safefilepath VendorGo standard library Affected before 1.20.11; 1.21.0-0 to before 1.21.4 Fixed in 1.20.11, 1.21.4 Patch available CNA
path/filepath VendorGo standard library Affected 1.20.11 to before 1.20.12; 1.21.4 to before 1.21.5 Fixed in 1.20.12, 1.21.5 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:golang:go::::::::	before 1.20.11; 1.21.0-0 to before 1.21.4	Vulnerable	Go standard library
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.20.11; 1.21.0-0 to before 1.21.4 Vulnerable ·Go standard library
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

Fix · CNA path/filepath (Go standard library) Fixed in 1.20.11, 1.21.4
Fix · CNA internal/safefilepath (Go standard library) Fixed in 1.20.11, 1.21.4
Fix · CNA path/filepath (Go standard library) Fixed in 1.20.12, 1.21.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-11-09
Go standard library path/filepath 1.20.11, 1.21.4
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2023-24274 Incorrect detection of reserved device names on Windows in path/filepathPriority LOW 32
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2023-45283
2026-10-03 Alias added: GHSA-vvjp-q62m-2vph

References

Advisory 4

Other 5

TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8

See all 170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences