CVE-2025-47906: Unexpected paths returned from LookPath in os/exec

Analyzed

AliasesRHSA-2025:22004RHSA-2025:22005RHSA-2025:23833+499 more

Published 18-09-2025Last modified 04-11-2025

Vulnerability summary

CVE-2025-47906 is a medium (CVSS 6.5) vulnerability in go standard library os/exec. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 46% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.55%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 30 · Related 86

MGASA-2025-0221 OPENSUSE-SU-2025:15420-1 OPENSUSE-SU-2025:15422-1 OPENSUSE-SU-2025:15423-1 OPENSUSE-SU-2025:15566-1 OPENSUSE-SU-2025:15586-1+81 more

Timeline

18-09-2025
PublishedVulnerability first disclosed.
04-11-2025
Last modifiedVulnerability information updated.

Description

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

CVSS metrics

8 scores · 8 sources · 1 version

v3.16.5

EPSS trend

Probability

0.55%

Chance of exploitation in the next 30 days

Percentile

46%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.55% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (go.dev)
Maturity: unknown

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

addon-resizer< 1.8.23-r8
addon-resizer-compat< 1.8.23-r8
apm-server-fips-7.17< 7.17.29-r3
apm-server-fips-7.17-compat< 7.17.29-r3
azuredisk-csi-fips-1.28< 1.28.12-r5

azurefile-csi-fips-1.31< 1.31.7-r3
azurefile-csi-fips-1.31-compat< 1.31.7-r3
bank-vaults< 1.20.4-r33
bank-vaults-template< 1.20.4-r33
blob-csi-fips-1.24< 1.24.11-r4
blob-csi-fips-1.24-compat< 1.24.11-r4
blobfuse2< 2.4.2-r4
blobfuse2-health-monitor< 2.4.2-r4
blobfuse2-syslog< 2.4.2-r4
checksec< 3.0.2-r5
cloud-provider-aws-1.30< 1.30.8-r9
cloud-provider-aws-1.30-cloud-controller-manager< 1.30.8-r9
cloud-provider-aws-1.30-ecr-credential-provider< 1.30.8-r9
cloud-provider-aws-1.31< 1.31.7-r1
cloud-provider-aws-1.31-cloud-controller-manager< 1.31.7-r1
cloud-provider-aws-1.31-ecr-credential-provider< 1.31.7-r1
cloud-provider-aws-fips-1.29< 1.29.8-r10
cloud-provider-aws-fips-1.29-cloud-controller-manager< 1.29.8-r10
cloud-provider-aws-fips-1.29-ecr-credential-provider< 1.29.8-r10
cloud-provider-aws-fips-1.31< 1.31.7-r1
cloud-provider-aws-fips-1.31-cloud-controller-manager< 1.31.7-r1
cloud-provider-aws-fips-1.31-ecr-credential-provider< 1.31.7-r1
cluster-api-1.7< 1.7.9-r6
cluster-api-1.7-capd-manager< 1.7.9-r6
cluster-api-1.7-capd-manager-compat< 1.7.9-r6
cluster-api-1.7-clusterctl< 1.7.9-r6
cluster-api-1.7-clusterctl-compat< 1.7.9-r6
cluster-api-1.7-controller< 1.7.9-r6
cluster-api-1.7-controller-compat< 1.7.9-r6
cluster-api-1.7-kubeadm-bootstrap-controller< 1.7.9-r6
cluster-api-1.7-kubeadm-bootstrap-controller-compat< 1.7.9-r6
cluster-api-1.7-kubeadm-control-plane-controller< 1.7.9-r6
cluster-api-1.7-kubeadm-control-plane-controller-compat< 1.7.9-r6
configmap-reload-fips-0.11< 0.11.1-r18
configmap-reload-fips-0.12< 0.12.0-r17
confluent-common-docker< 7.6.0-r19
confluent-common-docker-base< 7.6.0-r19
consul-fips-1.19< 1.19.2-r40
consul-fips-1.19-oci-entrypoint< 1.19.2-r40
consul-fips-1.19-oci-entrypoint-compat< 1.19.2-r40
container-object-storage-interface< 0.2.1-r1
container-object-storage-interface-controller< 0.2.1-r1
container-object-storage-interface-controller-compat< 0.2.1-r1
container-object-storage-interface-sidecar< 0.2.1-r1
container-object-storage-interface-sidecar-compat< 0.2.1-r1
ctop< 0.7.7-r27
custom-pod-autoscaler-operator< 1.4.2-r2
custom-pod-autoscaler-operator-compat< 1.4.2-r2
dagdotdev< 0.0.17-r2
dex-k8s-authenticatorAll versions (No fix recorded)
docker-credential-ecr-login< 0.10.1-r2
eks-distro-fips-1.33< 1.33.18-r1
etcd-fips-3.4< 3.4.37-r6
gcp-compute-persistent-disk-csi-driver-fips-1.13< 1.13.9-r8
gcp-compute-persistent-disk-csi-driver-fips-1.18< 1.18.1-r1
git-lfs< 3.7.0-r2
git-lfs-config< 3.7.0-r2
gitsign< 0.13.0-r4
gitsign-config< 0.13.0-r4
gitsign-credential-cache< 0.13.0-r4
go-1.20All versions (No fix recorded)
go-1.22All versions (No fix recorded)
gostatsd< 28.3.0-r18
grafana-operator< 5.19.4-r1
grafana-operator-bitnami-compat< 5.19.4-r1
hivemind< 1.1.0-r10
k8sgpt-operator< 0.2.22-r2
k8sgpt-operator-compat< 0.2.22-r2
karma-fips< 0.121-r5
karpenter-0.33< 0.33.12-r8
karpenter-0.35< 0.35.12-r8
karpenter-1.2< 1.2.4-r3
karpenter-fips-0.33< 0.33.12-r3
karpenter-fips-0.34< 0.34.13-r3
karpenter-fips-0.35< 0.35.12-r11
karpenter-fips-1.0< 1.0.10-r4
karpenter-fips-1.1< 1.1.6-r4
katib-earlystopping< 0.19.0-r31
katib-suggestion-goptuna-compat< 0.19.0-r40
katib-suggestion-hyperband< 0.19.0-r31
katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
katib-suggestion-nas-darts< 0.19.0-r31
katib-suggestion-nas-enas< 0.19.0-r31
katib-suggestion-optuna-enas< 0.19.0-r31
katib-suggestion-pbt-enas< 0.19.0-r31
katib-suggestion-skopt-enas< 0.19.0-r31
katib-tfevent-metricscollector< 0.19.0-r31
knative-eventing-1.17< 1.17.6-r2
knative-eventing-1.17-channel-controller< 1.17.6-r2
knative-eventing-1.17-channel-controller-compat< 1.17.6-r2
knative-eventing-1.17-channel-dispatcher< 1.17.6-r2
knative-eventing-1.17-channel-dispatcher-compat< 1.17.6-r2
knative-eventing-1.17-controller< 1.17.6-r2
knative-eventing-1.17-controller-compat< 1.17.6-r2
knative-eventing-1.17-filter< 1.17.6-r2
knative-eventing-1.17-filter-compat< 1.17.6-r2
knative-eventing-1.17-ingress< 1.17.6-r2
knative-eventing-1.17-ingress-compat< 1.17.6-r2
knative-eventing-1.17-jobsink< 1.17.6-r2
knative-eventing-1.17-jobsink-compat< 1.17.6-r2
knative-eventing-1.17-mtchannel-broker< 1.17.6-r2
knative-eventing-1.17-mtchannel-broker-compat< 1.17.6-r2
knative-eventing-1.17-webhook< 1.17.6-r2
knative-eventing-1.17-webhook-compat< 1.17.6-r2
knative-eventing-fips-1.17< 1.17.6-r3
knative-eventing-fips-1.17-channel-controller< 1.17.6-r3
knative-eventing-fips-1.17-channel-dispatcher< 1.17.6-r3
knative-eventing-fips-1.17-controller< 1.17.6-r3
knative-eventing-fips-1.17-filter< 1.17.6-r3
knative-eventing-fips-1.17-ingress< 1.17.6-r3
knative-eventing-fips-1.17-jobsink< 1.17.6-r3
knative-eventing-fips-1.17-mtchannel-broker< 1.17.6-r3
knative-eventing-fips-1.17-webhook< 1.17.6-r3
knative-serving-1.17< 1.17.2-r4
knative-serving-1.17-activator< 1.17.2-r4
knative-serving-1.17-activator-compat< 1.17.2-r4
knative-serving-1.17-autoscaler< 1.17.2-r4
knative-serving-1.17-autoscaler-compat< 1.17.2-r4
knative-serving-1.17-controller< 1.17.2-r4
knative-serving-1.17-controller-compat< 1.17.2-r4
knative-serving-1.17-queue< 1.17.2-r4
knative-serving-1.17-queue-compat< 1.17.2-r4
knative-serving-1.17-webhook< 1.17.2-r4
knative-serving-1.17-webhook-compat< 1.17.2-r4
kserve-rest-proxy< 0.12.0-r10
kserve-rest-proxy-compat< 0.12.0-r10
kube-logging-operator-custom-runner-fips< 0.13.0-r2
kube-logging-operator-custom-runner-fips-compat< 0.13.0-r2
kube-vip< 1.0.0-r1
kube-vip-cloud-provider< 0.0.12-r4
kube-vip-cloud-provider-compat< 0.0.12-r4
kube-vip-compat< 1.0.0-r1
kuberay-operator< 1.4.2-r2
kuberay-operator-compat< 1.4.2-r2
kubernetes-csi-node-driver-registrar-fips-2.14< 2.14.0-r2
kubernetes-csi-node-driver-registrar-fips-2.14-compat< 2.14.0-r2
kubernetes-dashboard-fips< 7.13.0-r4
linkerd2-proxy-init< 2.4.3-r3
linkerd2-proxy-init-compat< 2.4.3-r3
local-path-provisioner< 0.0.32-r1
lvm-driver< 1.7.0-r2
lvm-driver-compat< 1.7.0-r2
mattmoor-chainit< 0.0.9-r25
mattmoor-chainit-init< 0.0.9-r25
memcached-exporter-fips< 0.15.3-r3
memcached-exporter-fips-iamguarded-compat< 0.15.3-r3
modelmesh-runtime-adapter< 0.12.0-r19
mongodb-kubernetes-operator< 0.13.0-r3
mongodb-kubernetes-operator-compat< 0.13.0-r3
mongodb-kubernetes-operator-readinessprobe< 0.13.0-r3
mongodb-kubernetes-operator-readinessprobe-compat< 0.13.0-r3
mongodb-kubernetes-operator-version-upgrade-post-start-hook< 0.13.0-r3
mongodb-kubernetes-operator-version-upgrade-post-start-hook-compat< 0.13.0-r3
nats< 0.2.4-r1
nemo< 2.4.0-r13
newrelic-fluent-bit-output-compat< 2.4.0-r5
newrelic-nri-statsd< 2.11.0-r8
node-problem-detector-compat-fips-0.8< 0.8.21-r3
node-problem-detector-fips-0.8< 0.8.21-r3
node-problem-detector-health-checker-fips-0.8< 0.8.21-r3
node-problem-detector-log-counter-fips-0.8< 0.8.21-r3
nvidia-nsight-compute-12.8< 2025.1.1.2-r8 | < 2025.1.1.2-r7
nvidia-nsight-compute-12.9< 2025.2.1.3-r5 | All versions (No fix recorded) | < 2025.2.1.3-r8
nvidia-nsight-compute-13.0< 2025.3.0.19-r2
nvidia-nsight-compute-13.1< 2025.4.1.2-r1 | < 2025.3.0.19-r0
nvidia-nsight-compute-13.2< 2026.1.1.2-r0
octo-sts< 0.5.3-r2
octo-sts-webhook< 0.5.3-r2
openbao-k8s-fips< 1.4.0-r13
php-fpm_exporter< 2.2.0-r16
prometheus-adapter-0.10< 0.10.1-r24
prometheus-beat-exporter-fips< 0.4.0-r16
prometheus-bind-exporter< 0.8.0-r13
prometheus-nats-exporter< 0.17.3-r3
prometheus-node-exporter-fips< 1.9.1-r7
prometheus-node-exporter-fips-iamguarded-compat< 1.9.1-r7
prometheus-process-exporter< 0.8.7-r2
pvc-autoresizer< 0.17.5-r1
pvc-autoresizer-compat< 0.17.5-r1
rancher-machine< 0.15.0.131-r2
scanner-test-golang-vulnerability-unfixedAll versions (No fix recorded)
secrets-store-csi-driver-fips< 1.5.3-r1
secrets-store-csi-driver-provider-aws< 2.0.0-r1
secrets-store-csi-driver-provider-aws-fips< 2.0.0-r1
sftpgo-plugin-geoipfilter< 1.0.10-r6
sftpgo-plugin-pubsub< 1.0.14-r7
shfmt< 3.12.0-r2
smarter-device-manager-fipsAll versions (No fix recorded)
stakater-reloader-0.0.119< 0.0.119-r23
stakater-reloader-0.0.128< 0.0.128-r22
stakater-reloader-compat-0.0.119< 0.0.119-r23
stakater-reloader-compat-0.0.128< 0.0.128-r22
terraform-provider-sendgrid-fips< 1.0.1-r7
terraform-provider-time< 0.13.1-r3

Show all 199

Alpine1 product

go≥ 1.24.0, < 1.24.6-r0

2 vendors · 200 products · Showing 200 of 312

References

29 links

go.dev/cl/691775ARTICLEWEBFIXPatch
go.dev/issue/74466ARTICLEWEBREPORTExploitIssue TrackingThird Party Advisory
groups.google.com/g/golang-announce/c/x5MKroML2yMARTICLEWEBMailing ListRelease Notes
pkg.go.dev/vuln/GO-2025-3956AdvisoryWEBVendor Advisory
www.openwall.com/lists/oss-security/2025/08/06/1WEBIssue TrackingMailing List
access.redhat.com/errata/RHSA-2025:22004Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2396546REPORT
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22004.jsonAdvisory
access.redhat.com/security/cve/CVE-2025-47906REPORT

Show all 29 references