CVE-2025-47906

6.5 MEDIUM

Published: September 18, 2025 Modified: January 27, 2026

Description

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://go.dev/cl/691775

Source: security@golang.org

Patch

https://go.dev/issue/74466

Source: security@golang.org

Exploit Issue Tracking Third Party Advisory

https://groups.google.com/g/golang-announce/c/x5MKroML2yM

Source: security@golang.org

Mailing List Release Notes

https://pkg.go.dev/vuln/GO-2025-3956

Source: security@golang.org

Vendor Advisory

http://www.openwall.com/lists/oss-security/2025/08/06/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Issue Tracking

5 reference(s) from NVD

Quick Stats

CVSS v3 Score

6.5 / 10.0

EPSS (Exploit Probability)

0.0%

8th percentile

Exploitation Status

Not in CISA KEV

Affected Vendors

golang