CVE-2025-22873VulnerabilityPublished 4 Feb 2026

CVE-2025-22873: Go standard library os · Relative Path Traversal

Affects Go standard library osSource CVE Database V5

Not known to be exploited · CVSS 3.8 Low : upgrade to 1.24.3 or 1.23.9 when convenient.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

3.8Low

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 14% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 1.24.3, 1.23.9

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Changed
Confidentiality: Low
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Changed: An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Go standard library os to 1.24.3 or 1.23.9.

Affected software

Product	Affected	Fixed in
Go standard libraryos	Affected <1.23.9 >=1.24.0-0 <1.24.3	Fixed in 1.24.3 1.23.9
Goos`pkg:golang/os`Other threats	Affected <1.23.9 >=1.24.0-0 <1.24.3	Fixed in 1.23.9 1.24.3

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

European organizations should prioritize upgrading Go to versions beyond 1.24.0-0 once official patches addressing CVE-2025-22873 are released. Until then, developers should implement additional validation on file paths passed to os.Root.Open to prevent filenames ending with "../" or other path traversal patterns. Employing strict input sanitization and canonicalization of file paths before opening them can reduce risk. Where possible, avoid relying solely on os.Root for sandboxing and complement it with OS-level sandboxing mechanisms such as containerization or mandatory access controls (e.g., AppArmor, SELinux). Conduct code audits to identify usage of os.Root.Open and assess exposure. For critical applications, consider restricting local user privileges to minimize the risk of exploitation by low-privileged users. Monitoring file system access patterns for unusual directory openings may help detect exploitation attempts. Finally, maintain awareness of updates from the Go project and apply patches promptly.

Description

CVE-2025-22873 is a relative path traversal vulnerability in the Go standard library's os package that allows opening the parent directory of a defined root directory by using a filename ending with ".. /". This vulnerability permits access only to the immediate parent directory, not to higher-level ancestors or files within the parent directory. It affects Go versions up to 1.24.0-0 and has a low CVSS score of 3.8, indicating limited impact. Exploitation requires local privileges and no user interaction but can lead to limited confidentiality exposure by allowing directory traversal beyond intended boundaries. No known exploits are currently reported in the wild. European organizations using vulnerable Go versions in applications that enforce directory restrictions via os.

Impact

For European organizations, the impact of CVE-2025-22873 is primarily related to confidentiality breaches due to unauthorized access to parent directories outside intended sandbox boundaries. Organizations that develop or deploy software written in Go and use the os package's Root.Open method for directory restrictions are at risk. This could include cloud service providers, financial institutions, and technology companies relying on Go for backend services. Although the vulnerability does not allow access to files within the parent directory, merely opening the directory can reveal directory existence and metadata, potentially aiding attackers in reconnaissance or privilege escalation chains. The low CVSS score and lack of known exploits suggest limited immediate risk; however, in sensitive environments where directory isolation is critical, even this limited traversal can undermine security assumptions. European organizations with strict data protection regulations (e.g., GDPR) must consider the potential for unauthorized data exposure. The vulnerability's local attack vector means that attackers need some level of access already, so it is less likely to be exploited remotely but could be leveraged by insiders or through chained exploits. Overall, the impact is low but non-negligible in high-security contexts.

CWE-23Relative Path Traversal (opens in a new tab)
Base weaknessOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
Operation · Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth.
OWASP Cheat Sheets
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V12.3.1 (opens in a new tab)
Attack patterns
Relative Path Traversal (opens in a new tab)
Manipulating Web Input to File System Calls (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Feb 2026, 07:34 UTC

WeaknessesCWE-23

Technical details

References

Community reviews

Related threats