CVE-2025-22873

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

• CWE-23

• https://go.dev/cl/670036Patch, Product
• https://go.dev/issue/73555Issue Tracking, Vendor Advisory
• https://groups.google.com/g/golang-announce/c/UZoIkUT367A/m/5WDxKizJAQAJMailing List, Release Notes
• https://pkg.go.dev/vuln/GO-2026-4403Issue Tracking, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2025/05/06/2Mailing List, Third Party Advisory

Published

Feb 4, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-22868An attacker can pass a malicious malformed token which cause…7.5
• CVE-2025-22869SSH servers which implement file transfer protocols are vuln…7.5
• CVE-2025-2287A local code execution vulnerability exists in the Rockwell …7.8
• CVE-2025-22870Matching of hosts against proxy patterns can improperly trea…4.4
• CVE-2025-22871The net/http package improperly accepts a bare LF as a line …9.1
• CVE-2025-22872The tokenizer incorrectly interprets tags with unquoted attr…6.5
• CVE-2025-22874Calling Verify with a VerifyOptions.KeyUsages that contains …7.5
• CVE-2025-2288A local code execution vulnerability exists in the Rockwell …7.8
• CVE-2025-22880Delta Electronics CNCSoft-G2 lacks proper validation of the …7.8
• CVE-2025-22881Delta Electronics CNCSoft-G2 lacks proper validation of the …7.8
• CVE-2025-22882Delta Electronics ISPSoft version 3.20 is vulnerable to a St…9.8
• CVE-2025-22883Delta Electronics ISPSoft version 3.20 is vulnerable to an O…9.8