onyx --cves cve-2022-32190

CVE-2022-32190

HIGHGo

score: <0.1
cvss: 7.5
epss: 2.2%
published: 2022-09-13
kev added: —
first seen: 2026-10-21

JoinPath and URL.JoinPath in Go do not remove ../ path elements appended to a relative path, resulting in URLs like 'https://go.dev/../go' despite documentation stating such elements are removed.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2022-09-13 Published
2026-10-21 Tracked by Onyx

Weaknesses

CWE-22

References 4

https://go.dev/cl/423514
https://go.dev/issue/54385
https://pkg.go.dev/vuln/GO-2022-0988
https://groups.google.com/g/golang-announce/c/x49AQzIVX-s