Directory traversal via invalid path normalization

Path traversal in Go standard library path/filepath before 1.17.11 and 1.18.0 through 1.18.2 allows attackers to read files on Windows. The Clean function removes a leading dot when the following path contains a colon, turning invalid relative input such as .\c: into the valid drive path c:. Exposure requires a consuming application to pass attacker-controlled paths to Clean and use the result; the demonstrated consequence is directory access outside the intended root.