Skip to content
CVE PROGRAM SOURCE RECORD3.8 Low

CVE-2025-22873

Improper access to parent directory of root in os

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library os

Default version status: unaffected

  • 0 to < 1.23.9affected
  • 1.24.0-0 to < 1.24.3affected

References