CVE-2025-22873
MediumSummary
A vulnerability in the os package of the Go standard library allows improper access to the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") opens the parent directory, bypassing access restrictions.
Risk Assessment
The risk involves bypassing the os.Root isolation mechanism, potentially leading to unauthorized access to the parent directory and possible data leakage or privilege escalation in applications using this feature.
Recommendation
It is recommended to immediately update to a patched version of Go (e.g., 1.22.10 or 1.23.4) and review application code for unsafe use of os.Root with such paths.
Original NVD description (English source)
It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained withi