VULNERABILITY INTELLIGENCE

CVE-2025-22873

CVSS score3.8 LOW

EPSS probability0.23%

CISA KEVNot currently listed

Published2026-02-04

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Description

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

Weakness classification

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-23

Primary references

security@golang.org — Patch, Product
security@golang.org — Issue Tracking, Vendor Advisory
security@golang.org — Mailing List, Release Notes
security@golang.org — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory