CVE-2025-22873

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

CVSS v3 3.8 LOW

3.8^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.0 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://go.dev/cl/670036	Patch Product
https://go.dev/issue/73555	Issue Tracking Vendor Advisory
https://groups.google.com/g/golang-announce/c/UZoIkUT367A/m/5WDxKizJAQAJ	Mailing List Release Notes
https://pkg.go.dev/vuln/GO-2026-4403	Vendor Advisory Issue Tracking
http://www.openwall.com/lists/oss-security/2025/05/06/2	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:golang:go::::::::
	cpe:2.3:a:golang:go::::::::

History

No history.

Information

Published : 2026-02-04 23:15

Updated : 2026-02-10 15:16

NVD link : CVE-2025-22873

Mitre link : CVE-2025-22873

CVE.ORG link : CVE-2025-22873

JSON object : View

Products Affected

golang

go

CWE

CWE-23

Relative Path Traversal

{"id": "CVE-2025-22873", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.0}]}, "published": "2026-02-04T23:15:54.220", "references": [{"url": "https://go.dev/cl/670036", "tags": ["Patch", "Product"], "source": "security@golang.org"}, {"url": "https://go.dev/issue/73555", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/UZoIkUT367A/m/5WDxKizJAQAJ", "tags": ["Mailing List", "Release Notes"], "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2026-4403", "tags": ["Vendor Advisory", "Issue Tracking"], "source": "security@golang.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/05/06/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "It was possible to improperly access the parent directory of an os.Root by opening a filename ending in \"../\". For example, Root.Open(\"../\") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent."}, {"lang": "es", "value": "Fue posible acceder de forma indebida al directorio padre de un os.Root al abrir un nombre de archivo que termina en '../'. Por ejemplo, Root.Open('../') abrir\u00eda el directorio padre del Root. Este escape solo permite abrir el propio directorio padre, no los ancestros del padre ni los archivos contenidos dentro del padre."}], "lastModified": "2026-02-10T15:16:40.057", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A122760-875E-46BB-9B57-DB449401ABB4", "versionEndExcluding": "1.23.9"}, {"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97948C01-99E9-49E8-84C6-0E9AFE120C80", "versionEndExcluding": "1.24.3", "versionStartIncluding": "1.24.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@golang.org"}