CVE-2025-22873
CVE-2025-22873 · Improper access to parent directory of root in os
This page contains facts from public vulnerability sources. Check the original advisory before updating.
It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.
CVSS 3.8 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
os
- Versions
- ≥ 0, < 1.23.9: Affected (semver)
- ≥ 1.24.0-0, < 1.24.3: Affected (semver)
Update to 1.23.9; Update to 1.24.3
golang-1.24 Debian:13
- Affected ranges
- ECOSYSTEM: < 1.24.4-1
Update to 1.24.4-1
golang-1.24 Ubuntu:22.04:LTS
- Versions
- 1.24.4-1ubuntu1~22.04.1
- 1.24.4-1ubuntu1~22.04.2
- 1.24.13-2~22.04.1
- 1.24.13-2~22.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.24 Ubuntu:24.04:LTS
- Versions
- 1.24.4-1ubuntu1~24.04.1
- 1.24.4-1ubuntu1~24.04.2
- 1.24.13-2~24.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.24 Ubuntu:25.10
- Versions
- 1.24.2-1
- 1.24.2-2
- 1.24.4-1
- 1.24.4-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.24 Ubuntu:26.04:LTS
- Versions
- 1.24.4-1ubuntu1
- 1.24.9-1
- 1.24.13-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published