CVE-2025-69725

Aliases:GHSA-mqqf-5wvp-8fh8GO-2026-4316DEBIAN-CVE-2025-69725CGA-322c-58f5-2jpmCGA-3q3p-7g22-479vCGA-3qhg-v2pc-mw95CGA-7w3f-3fqm-vg25CGA-98p5-83jj-j926CGA-fp2f-2mr7-vq5fCGA-g4rh-p76j-7p23CGA-g99m-f79m-5j37CGA-gfw3-4g88-m38mCGA-gwjc-48qg-j7m3CGA-j89q-m329-j8c7CGA-25hx-v9qx-vgggCGA-27qq-qp93-39wmCGA-299w-646g-7vp6CGA-2f4w-wv63-qvg2CGA-2h3r-hhfx-5rjqCGA-2p3g-2xjf-87g5CGA-3qg7-46qm-53hwCGA-3v9w-h8qw-5hggCGA-3vqv-4q7x-rqw2CGA-3wrj-xf84-9qwrCGA-3xj8-qrq9-rwqvCGA-46cq-c7wm-cq9vCGA-47pr-cp59-4g84CGA-48m8-276p-wr3wCGA-4v6c-2r3h-jx65CGA-4xf2-qj27-r794CGA-52mr-35mx-2hrmCGA-5c62-qr64-8x84CGA-5gqp-rmj8-v984CGA-5mxv-hgrm-586xCGA-5v8v-6fr9-pvgxCGA-6292-6v76-fjgcCGA-653m-5xvm-62vgCGA-6cvw-c52p-pwh9CGA-6hgw-487w-4rw6CGA-6mh5-7mcc-h5x5CGA-79c6-rq2j-9f78CGA-7gj9-rj84-f358CGA-7mf5-mj7r-7mrqCGA-7phq-q8h4-3wj5CGA-7rcm-gwm5-qjxhCGA-8446-mf74-vj89CGA-8gcp-24jj-52ccCGA-8j7g-pmgh-wjcwCGA-8prc-f692-947xCGA-9394-982j-7p42CGA-9785-76mh-3665CGA-9mwx-hf64-89rqCGA-9qgr-m2gv-vxhvCGA-9v7g-5g5c-3g6rCGA-c2p7-pr67-c4r9CGA-c9fj-rfqj-chm9CGA-cp45-c3wq-g75qCGA-cwcq-jwpf-hgqfCGA-cxc4-q4g5-gfc5CGA-f358-m24p-ccp8CGA-fhm9-w7j5-2jmrCGA-fpch-f5x9-fqhwCGA-frpv-vv29-2xccCGA-fxpq-vv5j-gc36CGA-g4cg-34hq-7p66CGA-g7w5-qg46-pc7hCGA-g88w-2pvq-825cCGA-gggj-cfqw-pr6mCGA-gm4w-5f57-mcqrCGA-gp98-95xm-qj97CGA-gq4w-x6cv-4p4fCGA-gwgr-54gx-9834CGA-h226-9fj5-vfr4CGA-h2c3-m8rm-hp4vCGA-h3cp-mhrg-2h89CGA-h3rr-5q42-mf3jCGA-h95p-973q-44rfCGA-h96m-wf8g-jgv4CGA-hf74-c272-6ff3CGA-hwv3-gh73-ch52CGA-j34p-h7q6-g4vwCGA-j4v4-6fcw-mfvvCGA-j5mw-5fg6-2gp8CGA-jjx7-4756-72hfCGA-jx4c-grv8-7qfvCGA-jx86-78f5-fr25CGA-m27h-ww86-w29gCGA-m4h8-33mf-r85cCGA-m5f6-phrp-p5hrCGA-m6gf-g9m9-x4r5CGA-m7mj-jq76-gr9xCGA-mf6c-cv9w-jgw3CGA-mr79-jr2p-gf78CGA-p56v-hg58-92j9CGA-p67h-j8p4-mhf7CGA-pcj4-93qh-w44cCGA-pfh4-65q4-m56mCGA-pg7r-hpvm-692xCGA-pww3-5hh5-958hCGA-pwxh-5g9m-75qgCGA-q268-2933-r58cCGA-q88r-8m69-g5rwCGA-q8vj-j66j-cwh8CGA-q9j5-xfhq-cvmpCGA-qc25-582g-jh8qCGA-qcw7-j3f6-p2fxCGA-qm2x-3cjp-2ccqCGA-qp27-p4wx-vgwgCGA-qp2v-8mwp-ph98CGA-qpvp-q2g8-5fmpCGA-qw68-r7vf-hq84CGA-qxrj-37x3-mf77CGA-r39h-m46f-v2wmCGA-r5r6-6w53-6xg2CGA-rg4g-56fg-m6m4CGA-rg7r-hg25-6qq4CGA-rhc2-644r-vqfpCGA-rqr6-9756-88c6CGA-rr3x-q7qr-79chCGA-rrfm-m3v3-j9g7CGA-rv57-44vh-jh5cCGA-rxrm-3367-6vq9CGA-v32v-hfm7-7xxrCGA-vrqm-6f8w-qqg6CGA-vwf6-qx56-5jfpCGA-vxw2-68wm-2fh4CGA-w3hv-5v4x-frfcCGA-w9gj-9537-mhpjCGA-w9r6-wmw6-w7hxCGA-wwx6-5rcg-4qx5CGA-x34f-g837-4f29CGA-x5j3-mf52-c8xxCGA-xc72-f69g-h6jgCGA-xh84-58hv-vcq8CGA-xhwv-w5jc-345fCGA-xq23-6jxj-ccwrCGA-xrj9-mg4j-8c67
Advisory lineage Upstream: 1 Downstream: 6
Upstream
GO-2026-4316
Deferred
Published: 19 Feb 2026, 00:00
Last modified:05 Jul 2026, 01:29

Vulnerability Summary

Overall Risk (default)
low
19/100
CVSS Score
4.7 MEDIUM
v3.1 (cve.org)
EPSS Score
0.22% LOW
0% probability +0.18%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

19 Feb 2026, 00:00
Published
Vulnerability first disclosed
05 Jul 2026, 01:29
Last Modified
Vulnerability information updated

Description

An Open Redirect vulnerability in the go-chi/chi >=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.

CVSS Metrics

  • v3.1•MEDIUM•Score: 4.7CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:C/UI:R
  • v3.1•MEDIUM•Score: 4.7CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

EPSS Trends

Current EPSS score: 0.22%• Percentile: 13%

Techniques & Countermeasures

  • CWE-601•URL Redirection to Untrusted Site ('Open Redirect')

    The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Affected Systems

  • chainguard•aws-lambda-runtime-interface-emulator

    < 1.35-r2

  • chainguard•aws-lambda-runtime-interface-emulator-fips

    < 1.35-r4 | < 1.35-r3

  • chainguard•cloudbeat-8.17

    < 8.17.10-r27

  • chainguard•cloudbeat-9.0

    < 9.0.8-r30

  • chainguard•cloudbeat-9.1

    < 0

  • chainguard•cloudbeat-fips-8.17

    < 8.17.10-r32

  • chainguard•cloudbeat-fips-9.0

    < 9.0.8-r34

  • chainguard•cloudbeat-fips-9.1

    < 0

  • chainguard•cloudflared

    < 0

  • chainguard•cloudflared-fips

    < 0

  • chainguard•commercial-kyverno-1.15

    < 1.15.2-r0

  • chainguard•commercial-kyverno-background-controller-1.15

    < 1.15.2-r0

  • chainguard•commercial-kyverno-cleanup-controller-1.15

    < 1.15.2-r0

  • chainguard•commercial-kyverno-reports-controller-1.15

    < 1.15.2-r0

  • chainguard•commercial-kyvernopre-1.15

    < 1.15.2-r0

  • chainguard•cortex

    < 0

  • chainguard•cortex-fips

    < 0

  • chainguard•cosmo-router

    < 0

  • chainguard•cosmo-router-fips

    < 0

  • chainguard•custom-pod-autoscaler

    < 2.12.2-r12

  • chainguard•custom-pod-autoscaler-fips

    < 2.12.2-r14

  • chainguard•dapr-daprd-1.14

    all

  • chainguard•dapr-daprd-1.15

    < 0

  • chainguard•dapr-daprd-1.16

    < 0

  • chainguard•dapr-daprd-1.17

    < 0

  • chainguard•dapr-daprd-1.18

    < 0

  • chainguard•dapr-daprd-fips-1.14

    all

  • chainguard•dapr-daprd-fips-1.15

    < 0

  • chainguard•dapr-daprd-fips-1.16

    < 0

  • chainguard•dapr-daprd-fips-1.17

    < 0

  • chainguard•dapr-daprd-fips-1.18

    < 0

  • chainguard•drone

    < 0

  • chainguard•drone-fips

    < 0

  • chainguard•fleet-server-9.1

    all

  • chainguard•fleet-server-fips-9.1

    < 9.1.10-r11

  • chainguard•gitness

    < 0

  • chainguard•influxd-2.7

    < 0

  • chainguard•influxd-fips-2.7

    < 0

  • chainguard•kyverno-1.14

    < 0

  • chainguard•kyverno-1.15

    < 0

  • chainguard•kyverno-background-controller-1.14

    < 0

  • chainguard•kyverno-background-controller-1.15

    < 0

  • chainguard•kyverno-background-controller-fips-1.14

    < 1.14.5-r12

  • chainguard•kyverno-background-controller-fips-1.15

    < 0

  • chainguard•kyverno-cleanup-controller-1.14

    < 0

  • chainguard•kyverno-cleanup-controller-1.15

    < 0

  • chainguard•kyverno-cleanup-controller-fips-1.14

    < 1.14.5-r12

  • chainguard•kyverno-cleanup-controller-fips-1.15

    < 0

  • chainguard•kyverno-cli-1.14

    < 0

  • chainguard•kyverno-cli-1.15

    < 0

Showing first 50 affected entries in server-rendered view.

References (7)