VulnerabilityAnalyzed
CVE-2025-47906
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
MEDIUM 6.5EPSS 0.52%
Does this matter?
Lower severity and a low EPSS score (0.52%). Track it; it rarely justifies an emergency change on its own.
Description
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
- EPSS
- 0.52% probability · 43th percentile
- CISA KEV
- Not listed
- Affected
- golang/go
- Source
- security@golang.org
References
- https://go.dev/cl/691775Patch
- https://go.dev/issue/74466Exploit, Issue Tracking, Third Party Advisory
- https://groups.google.com/g/golang-announce/c/x5MKroML2yMMailing List, Release Notes
- https://pkg.go.dev/vuln/GO-2025-3956Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/08/06/1Issue Tracking, Mailing List
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.