CVE-2025-47906
MediumSummary
A vulnerability in the LookPath function causes that when the PATH environment variable contains paths to executable files (rather than just directories), passing certain strings ("", ".", "..") can unexpectedly return binaries listed in PATH.
Risk Assessment
The risk is that an attacker could manipulate PATH to force the execution of unintended executables, potentially leading to privilege escalation or malicious code execution.
Recommendation
It is recommended to immediately update to a patched version and avoid placing paths to executable files instead of directories in the PATH variable.
Original NVD description (English source)
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.