CVE-2025-22873

Katalog CVE

CVSS 3.8 · Low EPSS 0,24%

Kerentanan Relative Path Traversal pada golang go. Skor CVSS 3.1 3.8 (Low) menurut CISA ADP.

Deskripsi (NVD)

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

Rincian

Terbit di NVD

4 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.8 (Low), sumber CISA ADP
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-23: Relative Path Traversal

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://go.dev/issue/73555 issue tracking · advisory vendor
• https://pkg.go.dev/vuln/GO-2026-4403 issue tracking · advisory vendor
• https://go.dev/cl/670036 patch · product
• http://www.openwall.com/lists/oss-security/2025/05/06/2 mailing list · advisory pihak ketiga
• https://groups.google.com/g/golang-announce/c/UZoIkUT367A/m/5WDxKizJAQAJ mailing list · release notes