Overview · devld/go-drive · GitHub

Repository navigation

Security

No security policy detected

This project has not set up a SECURITY.md file yet.

Report a vulnerability

Per-path permission (PathPermission) bypass via filesystem name aliases — case variant, Windows 8.3 short name, and trailing-dot segment — on the local fs drive
GHSA-g338-hxp9-2hqm published Oct 17, 2026 by devld

Moderate
Windows path traversal via unsanitized backslashes in go-drive fs drive lets an authenticated low-privileged user write, delete, and mkdir arbitrary files outside the drive root, bypassing the per-path ACL and chroot jail.
GHSA-jvhp-gq6m-ghc3 published Sep 12, 2026 by devld

High

Learn more about advisories related to devld/go-drive in the GitHub Advisory Database