CVEvulnerability
CVE-2025-47906
6.5 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2025-09-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Description
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
Affected configurations
• golang go (< 1.23.12)
• golang go (>= 1.24.0 < 1.24.6)
References
- https://go.dev/cl/691775 Patch
- https://go.dev/issue/74466 Exploit, Issue Tracking, Third Party Advisory
- https://groups.google.com/g/golang-announce/c/x5MKroML2yM Mailing List, Release Notes
- https://pkg.go.dev/vuln/GO-2025-3956 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/08/06/1 Issue Tracking, Mailing List