CVE-2025-22873

Aliases:GO-2026-4403BIT-golang-2025-22873DEBIAN-CVE-2025-22873CGA-23fm-4mh4-2vp5CGA-24xq-95h6-wgx2CGA-25ph-x9hf-x555CGA-2g4w-f4r5-c83qCGA-2q6m-j2cg-hgjcCGA-35v5-qqfq-xm8gCGA-37f3-2xpx-fvr3CGA-3hfh-2777-7632CGA-3w5m-8385-8pfxCGA-44rx-vvhx-4mwwCGA-48rq-3w2x-hf3wCGA-49x7-4p95-wc3pCGA-4qp8-9mhr-f24fCGA-4rrr-4wm3-988rCGA-54qw-3c36-hc3xCGA-55w5-ff7f-6hpwCGA-5cv7-p62h-cpxhCGA-5ffp-9pvc-q2vfCGA-5hp4-5jcr-v5jwCGA-5wq6-5q75-fvg7CGA-5xxx-2j8c-ghjvCGA-69x5-pqqh-2h2rCGA-6qc7-8cfh-pv2fCGA-6xrc-qq8x-478rCGA-78pr-q7xq-8g39CGA-7c57-rw6m-mpq6CGA-7m88-8qx6-jj95CGA-7r7g-45f5-fvvvCGA-7v9j-5vrg-h7r6CGA-83hx-2749-vpr5CGA-85wf-6pc3-9m62CGA-86wc-75h9-2f4wCGA-8844-257h-c2wrCGA-8965-g32g-xvvmCGA-8fp3-7fqw-5qhxCGA-8gmf-v6gc-22gcCGA-8m5j-v43r-wcw4CGA-8qgj-w335-whc5CGA-8x62-6rhr-qmvrCGA-92vp-6wx2-9257CGA-958m-mp35-7x6cCGA-9jhw-rh42-5w43CGA-9mqp-q5vc-vh3gCGA-9xcx-5mf4-2v4mCGA-c3m6-px87-247xCGA-c97c-wp9v-qj94CGA-ccgg-7f9c-5gm3CGA-cj4m-qwpm-fqrcCGA-cm7h-g366-ghg6CGA-crgc-x962-cv3mCGA-cxcc-pfh7-7p83CGA-f8mf-9hxm-jmwxCGA-fc25-gpv7-mqgpCGA-fh57-x4q5-v9pvCGA-fpxv-8m3j-65pxCGA-fqr3-9j57-7qg3CGA-fr75-cqcc-28qwCGA-frxw-9mh4-h223CGA-g8r9-5r23-9hv6CGA-gg4c-r75m-crq2CGA-gh26-v4jc-7hh2CGA-ghpp-vqpv-x8pcCGA-ghpw-f274-fm9mCGA-gjp7-6g6m-fgrcCGA-gm9h-j2fj-85f3CGA-gmvw-jgm6-7c46CGA-gv5m-6h3v-r6wpCGA-gxc9-hmhq-v47fCGA-jhx3-9832-hjg6CGA-jmm6-jp85-g482CGA-jxvj-g965-9crqCGA-m269-qgcr-56f4CGA-m35c-qfjf-x6cmCGA-m9wm-j3rg-pghxCGA-mqq9-g4qp-26rrCGA-mxvh-p9f2-f4p8CGA-p48c-g56x-6hm9CGA-pf3f-xrjp-vj9rCGA-pf6h-xx3g-wjqcCGA-pfgw-rqp6-9x8fCGA-pqmq-4pmf-pxqpCGA-pr87-3wfr-p599CGA-pw2m-p7c8-846rCGA-pxf6-phj5-7jx3CGA-74q3-9229-qfqrCGA-7g8p-rvhq-gfp6CGA-8cr3-fcgp-53mcCGA-ppgm-h3qm-w59rCGA-q62r-8c2g-6x7jCGA-q938-h29f-7vw2CGA-qggg-25rv-q74vCGA-qppm-5pp4-7qp9CGA-qpvf-h2fh-8g45CGA-qpvr-7pj3-4gqwCGA-qvpp-5xpx-29qjCGA-r487-xxrv-g6gvCGA-r5q8-43fg-j3j8CGA-r8v3-hm77-mm2fCGA-r969-m8pr-p9fqCGA-r98r-hrvm-5jfqCGA-rm26-wj78-xqmgCGA-rp34-c2jm-3w28CGA-rrjc-99vf-v723CGA-vc96-phv7-x4g3CGA-vcr4-mhg3-r5c8CGA-w552-rwxv-5q5xCGA-w67g-78g5-8mggCGA-xh42-48hv-7fm9CGA-xw4j-grfx-24jrCGA-5259-8w82-vh55CGA-ggw5-mvq2-rv3h
Advisory lineage Upstream: 0 Downstream: 10
Analyzed
Published: 04 Feb 2026, 23:05
Last modified:05 Feb 2026, 15:03

Vulnerability Summary

Overall Risk (default)
low
15/100
CVSS Score
3.8 LOW
v3.1 (cve.org)
EPSS Score
0.24% LOW
0% probability +0.24%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

04 Feb 2026, 23:05
Published
Vulnerability first disclosed
05 Feb 2026, 15:03
Last Modified
Vulnerability information updated

Description

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

CVSS Metrics

  • v3.1•LOW•Score: 3.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

EPSS Trends

Current EPSS score: 0.24%• Percentile: 16%

Techniques & Countermeasures

  • CWE-23•Relative Path Traversal

    The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Affected Systems

  • chainguard•go-1.20

    all | < 0

  • chainguard•go-1.22

    all | < 0

  • chainguard•katib-earlystopping

    < 0.19.0-r31

  • chainguard•katib-suggestion-goptuna-compat

    all

  • chainguard•katib-suggestion-hyperband

    < 0.19.0-r31

  • chainguard•katib-suggestion-hyperopt

    < 0.19.0-r31 | < 0.19.0-r40

  • chainguard•katib-suggestion-nas-darts

    < 0.19.0-r31

  • chainguard•katib-suggestion-nas-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-optuna-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-pbt-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-skopt-enas

    < 0.19.0-r31

  • chainguard•katib-tfevent-metricscollector

    < 0.19.0-r31

  • chainguard•nvidia-nsight-compute-12.8

    all

  • chainguard•nvidia-nsight-compute-12.9

    all

  • chainguard•nvidia-nsight-compute-13.0

    all

  • chainguard•nvidia-nsight-compute-13.1

    all

  • chainguard•nvidia-nsight-compute-13.2

    < 2026.1.1.2-r0

  • wolfi•go-1.20

    all | < 0

  • wolfi•go-1.22

    all | < 0

  • wolfi•katib-earlystopping

    < 0.19.0-r31

  • wolfi•katib-suggestion-goptuna-compat

    all

  • wolfi•katib-suggestion-hyperband

    < 0.19.0-r31

  • wolfi•katib-suggestion-hyperopt

    < 0.19.0-r31 | < 0.19.0-r40

  • wolfi•katib-suggestion-nas-darts

    < 0.19.0-r31

  • wolfi•katib-suggestion-nas-enas

    < 0.19.0-r31

  • wolfi•katib-suggestion-optuna-enas

    < 0.19.0-r31

  • wolfi•katib-suggestion-pbt-enas

    < 0.19.0-r31

  • wolfi•katib-suggestion-skopt-enas

    < 0.19.0-r31

  • wolfi•katib-tfevent-metricscollector

    < 0.19.0-r31

  • debian•golang-1.24

    < 1.24.4-1

  • go standard library•os

    < 1.23.9 | ≥ 1.24.0-0, < 1.24.3

  • golang•go

    < 1.23.9 | ≥ 1.24.0, < 1.24.3

  • Go•stdlib

    ≥ 1.24.0-0, < 1.24.3

References (9)