CVE-2025-22873 PUBLISHED

Improper access to parent directory of root in os

Assigner: Go
Reserved: 08.01.2025 Published: 04.02.2026 Updated: 05.02.2026

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

Product Status

Vendor Go standard library
Product os
Versions Default: unaffected
  • affected from 0 to 1.23.9 (excl.)
  • affected from 1.24.0-0 to 1.24.3 (excl.)

Credits

  • Dan Sebastian Thrane of SDU eScience Center

References

Problem Types

  • CWE-23: Relative Path Traversal