CVE-2025-22873

Description

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

PUBLISHED Reserved 2025-01-08 | Published 2026-02-04 | Updated 2026-02-04 | Assigner Go

Problem types

CWE-23: Relative Path Traversal

Product status

Credits

Dan Sebastian Thrane of SDU eScience Center

References

www.openwall.com/lists/oss-security/2025/05/06/2

go.dev/cl/670036

go.dev/issue/73555

groups.google.com/...g-announce/c/UZoIkUT367A/m/5WDxKizJAQAJ

pkg.go.dev/vuln/GO-2026-4403

cve.org (CVE-2025-22873)

nvd.nist.gov (CVE-2025-22873)

Download JSON