CVE-2025-22873

3.8 LOW
Published: February 04, 2026 Modified: February 10, 2026
View on NVD

Description

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://go.dev/cl/670036
Source: security@golang.org
Patch Product
https://go.dev/issue/73555
Source: security@golang.org
Issue Tracking Vendor Advisory
https://groups.google.com/g/golang-announce/c/UZoIkUT367A/m/5WDxKizJAQAJ
Source: security@golang.org
Mailing List Release Notes
https://pkg.go.dev/vuln/GO-2026-4403
Source: security@golang.org
Vendor Advisory Issue Tracking
http://www.openwall.com/lists/oss-security/2025/05/06/2
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Third Party Advisory

5 reference(s) from NVD

Quick Stats

CVSS v3 Score
3.8 / 10.0
EPSS (Exploit Probability)
0.0%
0th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-23

Affected Vendors

golang

Related CVEs

CVE-2026-4519 N/A
CVE-2026-4487 8.8
CVE-2026-33312 N/A
CVE-2026-29794 5.3
CVE-2026-22172 9.9