{"schema_version":"1.3.1","id":"GO-2023-2048","modified":"2024-05-20T16:03:47Z","published":"2023-09-13T19:45:03Z","aliases":["GHSA-6xv5-86q9-7xr8"],"summary":"Paths outside of the rootfs could be produced on Windows in github.com/cyphar/filepath-securejoin","details":"Certain rootfs and path combinations result in generated paths that are outside of the provided rootfs on Windows.","affected":[{"package":{"name":"github.com/cyphar/filepath-securejoin","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.4"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/cyphar/filepath-securejoin","goos":["windows"],"symbols":["SecureJoin","SecureJoinVFS"]}]}}],"references":[{"type":"ADVISORY","url":"https://github.com/cyphar/filepath-securejoin/security/advisories/GHSA-6xv5-86q9-7xr8"},{"type":"FIX","url":"https://github.com/cyphar/filepath-securejoin/commit/c121231e1276e11049547bee5ce68d5a2cfe2d9b"}],"credits":[{"name":"@pjbgf"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2023-2048","review_status":"REVIEWED"}}