CVE-2022-41720

score

<0.1

cvss

7.5

epss

1.3%

published

2022-12-07

kev added

—

first seen

2026-10-21

On Windows, os.DirFS and http.Dir provide read-only access to directory trees, but can access device files like COM1. An os.DirFS for the drive root may allow path traversal to system files. The fix changes os.DirFS("") behavior, now returning an error instead of root path.