What version of Go are you using (go version)?

# go version
go version go1.13.1 linux/amd64

Does this issue reproduce with the latest release?

Yes. Using golang:latest

What operating system and processor architecture are you using (go env)?

# go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/root/.cache/go-build"
GOENV="/root/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build633713348=/tmp/go-build -gno-record-gcc-switches"

What did you do?

package main

import (
	"fmt"
	"path"
	"path/filepath"
)

func main() {
		basedir := "/tmp"
		fmt.Println(path.Join(basedir, filepath.Clean("../../../.../../../../../../"), "file.txt"))
		fmt.Println(path.Join(basedir, filepath.Clean("/../../../.../../../../../../"), "file.txt"))

}

https://play.golang.org/p/sbCquGUpnyc

What did you expect to see?

/tmp/file.txt
/tmp/file.txt

What did you see instead?

/file.txt
/tmp/file.txt

Seems like filepath.Clean does not clean path completely. Therefore, filepath.Clean cannot be used as safe sanitizer against LFI/doubledot/directory traversal type of attacks.