SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Impact For Windows users of `github.com/cyphar/filepath-securejoin`, until v0.2.4 it was possible for certain rootfs and path combinations (in particular, where a malicious Unix-style `/`-separated unsafe path was used with a Windows-style rootfs path) to result in generated paths that were outside of the provided rootfs. It is unclear to what extent this has a practical impact on real users, but given the possible severity of the issue we have released an emergency patch release that resolves this issue. Thanks to @pjbgf for discovering, debugging, and fixing this issue (as well as writing some tests for it). ### Patches c121231e1276e11049547bee5ce68d5a2cfe2d9b is the patch fixing this issue. v0.2.4 contains the fix. ### Workarounds Users could use `filepath.FromSlash()` on all unsafe paths before passing them to `filepath-securejoin`. ### References See #9.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | github.com/cyphar/filepath-securejoin (Go) | before 0.2.4 | 0.2.4 | Patch available | GHSA-6xv5-86q9-7xr8 |
- github.com/cyphar/filepath-securejoin (Go) Vendor— Affected before 0.2.4 Fixed in 0.2.4 Patch available GHSA-6xv5-86q9-7xr8
Remediation
- Fix · GHSA-6xv5-86q9-7xr8 github.com/cyphar/filepath-securejoin (Go) Fixed in 0.2.4 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-6xv5-86q9-7xr8
References
Other 5
- https://github.com/cyphar/filepath-securejoin/security/advisories/GHSA-6xv5-86q9-7xr8
- https://github.com/cyphar/filepath-securejoin/pull/9
- https://github.com/cyphar/filepath-securejoin/commit/c121231e1276e11049547bee5ce68d5a2cfe2d9b
- https://github.com/cyphar/filepath-securejoin
- https://github.com/cyphar/filepath-securejoin/releases/tag/v0.2.4
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences