CVE-2025-22873

LowCVSS 3.8/10Last modified Jun 17, 2026

Description

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-23

Affected software

Vendor	Product	Versions
Go standard library	os	< 1.23.9; >= 1.24.0-0, < 1.24.3

References

https://go.dev/cl/670036Patch, Product
https://go.dev/issue/73555Issue Tracking, Vendor Advisory
https://groups.google.com/g/golang-announce/c/UZoIkUT367A/m/5WDxKizJAQAJMailing List, Release Notes
https://pkg.go.dev/vuln/GO-2026-4403Issue Tracking, Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/05/06/2Mailing List, Third Party Advisory

Timeline

Published: Feb 4, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-228747.5Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected cer CVE-2025-22887.8A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the alloc CVE-2025-228807.8Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based bu CVE-2025-228817.8Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based bu CVE-2025-228829.8Delta Electronics ISPSoft version 3.20 is vulnerable to a Stack-Based buffer overflow vulnerability that could allow an attacker to leverage CVE-2025-228839.8Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitra CVE-2025-228849.8Delta Electronics ISPSoft version 3.20 is vulnerable to a Stack-Based buffer overflow vulnerability that could allow an attacker to execute CVE-2025-228854.7Improper buffer restrictions in the firmware for the TDX Module may allow an escalation of privilege. System software adversary with a privi CVE-2025-228865.5in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.CVE-2025-228885.4Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. If exploited, an arbitra CVE-2025-228897.9Improper handling of overlap between protected memory ranges for some Intel(R) Xeon(R) 6 processor with Intel(R) TDX may allow a privileged CVE-2025-22898.8The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJA