CVE-2025-47906

Description

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

EPSS Trends

Current EPSS score: 0.52%• Percentile: 43%

Affected Systems

• chainguard•addon-resizer

  < 1.8.23-r8

• chainguard•addon-resizer-compat

  < 1.8.23-r8

• chainguard•apm-server-fips-7.17

  < 7.17.29-r3

• chainguard•apm-server-fips-7.17-compat

  < 7.17.29-r3

• chainguard•azuredisk-csi-fips-1.28

  < 1.28.12-r5

• chainguard•azurefile-csi-fips-1.31

  < 1.31.7-r3

• chainguard•azurefile-csi-fips-1.31-compat

  < 1.31.7-r3

• chainguard•bank-vaults

  < 1.20.4-r33

• chainguard•bank-vaults-template

  < 1.20.4-r33

• chainguard•blob-csi-fips-1.24

  < 1.24.11-r4

• chainguard•blob-csi-fips-1.24-compat

  < 1.24.11-r4

• chainguard•blobfuse2

  < 2.4.2-r4

• chainguard•blobfuse2-health-monitor

  < 2.4.2-r4

• chainguard•blobfuse2-syslog

  < 2.4.2-r4

• chainguard•checksec

  < 3.0.2-r5

• chainguard•cloud-provider-aws-1.30

  < 1.30.8-r9

• chainguard•cloud-provider-aws-1.30-cloud-controller-manager

  < 1.30.8-r9

• chainguard•cloud-provider-aws-1.30-ecr-credential-provider

  < 1.30.8-r9

• chainguard•cloud-provider-aws-1.31

  < 1.31.7-r1

• chainguard•cloud-provider-aws-1.31-cloud-controller-manager

  < 1.31.7-r1

• chainguard•cloud-provider-aws-1.31-ecr-credential-provider

  < 1.31.7-r1

• chainguard•cloud-provider-aws-fips-1.29

  < 1.29.8-r10

• chainguard•cloud-provider-aws-fips-1.29-cloud-controller-manager

  < 1.29.8-r10

• chainguard•cloud-provider-aws-fips-1.29-ecr-credential-provider

  < 1.29.8-r10

• chainguard•cloud-provider-aws-fips-1.31

  < 1.31.7-r1

• chainguard•cloud-provider-aws-fips-1.31-cloud-controller-manager

  < 1.31.7-r1

• chainguard•cloud-provider-aws-fips-1.31-ecr-credential-provider

  < 1.31.7-r1

• chainguard•cluster-api-1.7

  < 1.7.9-r6

• chainguard•cluster-api-1.7-capd-manager

  < 1.7.9-r6

• chainguard•cluster-api-1.7-capd-manager-compat

  < 1.7.9-r6

• chainguard•cluster-api-1.7-clusterctl

  < 1.7.9-r6

• chainguard•cluster-api-1.7-clusterctl-compat

  < 1.7.9-r6

• chainguard•cluster-api-1.7-controller

  < 1.7.9-r6

• chainguard•cluster-api-1.7-controller-compat

  < 1.7.9-r6

• chainguard•cluster-api-1.7-kubeadm-bootstrap-controller

  < 1.7.9-r6

• chainguard•cluster-api-1.7-kubeadm-bootstrap-controller-compat

  < 1.7.9-r6

• chainguard•cluster-api-1.7-kubeadm-control-plane-controller

  < 1.7.9-r6

• chainguard•cluster-api-1.7-kubeadm-control-plane-controller-compat

  < 1.7.9-r6

• chainguard•configmap-reload-fips-0.11

  < 0.11.1-r18

• chainguard•configmap-reload-fips-0.12

  < 0.12.0-r17

• chainguard•confluent-common-docker

  < 7.6.0-r19

• chainguard•confluent-common-docker-base

  < 7.6.0-r19

• chainguard•consul-fips-1.19

  < 1.19.2-r40

• chainguard•consul-fips-1.19-oci-entrypoint

  < 1.19.2-r40

• chainguard•consul-fips-1.19-oci-entrypoint-compat

  < 1.19.2-r40

• chainguard•container-object-storage-interface

  < 0.2.1-r1

• chainguard•container-object-storage-interface-controller

  < 0.2.1-r1

• chainguard•container-object-storage-interface-controller-compat

  < 0.2.1-r1

• chainguard•container-object-storage-interface-sidecar

  < 0.2.1-r1

• chainguard•container-object-storage-interface-sidecar-compat

  < 0.2.1-r1

Showing first 50 affected entries in server-rendered view.

References (23)

• https://go.dev/cl/691775
• https://go.dev/issue/74466
• https://groups.google.com/g/golang-announce/c/x5MKroML2yM
• https://pkg.go.dev/vuln/GO-2025-3956
• http://www.openwall.com/lists/oss-security/2025/08/06/1
• https://security-tracker.debian.org/tracker/CVE-2025-47906
• https://pkg.go.dev
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47906.json
• https://nvd.nist.gov/vuln/detail/CVE-2025-47906
• https://access.redhat.com/errata/RHSA-2025:22004
• https://access.redhat.com/security/updates/classification/#moderate
• https://bugzilla.redhat.com/show_bug.cgi?id=2396546
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22004.json
• https://access.redhat.com/security/cve/CVE-2025-47906
• https://www.cve.org/CVERecord?id=CVE-2025-47906
• https://access.redhat.com/errata/RHSA-2025:22005
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22005.json
• https://access.redhat.com/errata/RHSA-2025:23833
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23833.json
• https://access.redhat.com/errata/RHSA-2025:23834
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23834.json
• https://access.redhat.com/errata/RHSA-2025:23851
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23851.json