« Volver al listado

CVE-2025-22873

Estado: AnalizadaBaja (3.8)—

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Golang — GO

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-22873",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-22873",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-05T15:03:11.291122Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 3.8,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "security@golang.org",
      "affectedData": [
        {
          "vendor": "Go standard library",
          "product": "os",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.23.9",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.24.0-0",
              "lessThan": "1.24.3",
              "versionType": "semver"
            }
          ],
          "packageName": "os",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "splitPathInRoot"
            },
            {
              "name": "checkPathEscapesInternal"
            },
            {
              "name": "doInRoot"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-04T23:15:54.220",
  "references": [
    {
      "url": "https://go.dev/cl/670036",
      "tags": [
        "Patch",
        "Product"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://go.dev/issue/73555",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://groups.google.com/g/golang-announce/c/UZoIkUT367A/m/5WDxKizJAQAJ",
      "tags": [
        "Mailing List",
        "Release Notes"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2026-4403",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/05/06/2",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-23"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "It was possible to improperly access the parent directory of an os.Root by opening a filename ending in \"../\". For example, Root.Open(\"../\") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent."
    },
    {
      "lang": "es",
      "value": "Fue posible acceder de forma indebida al directorio padre de un os.Root al abrir un nombre de archivo que termina en '../'. Por ejemplo, Root.Open('../') abriría el directorio padre del Root. Este escape solo permite abrir el propio directorio padre, no los ancestros del padre ni los archivos contenidos dentro del padre."
    }
  ],
  "lastModified": "2026-06-17T08:50:42.207",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A122760-875E-46BB-9B57-DB449401ABB4",
              "versionEndExcluding": "1.23.9"
            },
            {
              "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97948C01-99E9-49E8-84C6-0E9AFE120C80",
              "versionEndExcluding": "1.24.3",
              "versionStartIncluding": "1.24.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@golang.org"
}