CVE-2025-22873

Description

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

CVSS Metrics

• v3.1•LOW•Score: 3.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

EPSS Trends

Current EPSS score: 0.00%• Percentile: 0%

Techniques & Countermeasures

• CWE-23•Relative Path Traversal

  The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Affected Systems

• go standard library•os

  < 1.23.9 | ≥ 1.24.0-0, < 1.24.3

• golang•go

  < 1.23.9 | ≥ 1.24.0, < 1.24.3

• Go•stdlib

  ≥ 1.24.0-0, < 1.24.3

References (5)

• https://go.dev/cl/670036
• https://go.dev/issue/73555
• https://groups.google.com/g/golang-announce/c/UZoIkUT367A/m/5WDxKizJAQAJ
• https://pkg.go.dev/vuln/GO-2026-4403
• http://www.openwall.com/lists/oss-security/2025/05/06/2