Low severity · published Feb 4, 2026
CVE-2025-22873
Improper access to parent directory of root in os
3.8
CVSS
0.2%
EPSS
No
On KEV
Description
It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
os · Go standard library
before 1.23.9; 1.24.0-0 before 1.24.3 · source: vendor
GO
GO · Golang
before 1.23.9; 1.24.0 before 1.24.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-22873
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-22873
Patch
https://go.dev/cl/670036
Issue Tracking
https://go.dev/issue/73555
Mailing List
https://groups.google.com/g/golang-announce/c/UZoIkUT367A/m/5WDxKizJAQAJ
Issue Tracking
https://pkg.go.dev/vuln/GO-2026-4403
Mailing List
http://www.openwall.com/lists/oss-security/2025/05/06/2
More from os
9.8
CVE-2026-56857
Root.Mkdir(All) can follow junctions out of the root on Windows in os
7.8
CVE-2026-39822
Root escape via symlink plus trailing slash in os
2.5
CVE-2026-27139
FileInfo can escape from a Root in os