CVE-2025-47906 - Vulnerability Details - OpenCVE

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://go.dev/cl/691775
https://go.dev/issue/74466
https://groups.google.com/g/golang-announce/c/x5MKroML2yM
https://pkg.go.dev/vuln/GO-2025-3956

History

Thu, 18 Sep 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 18 Sep 2025 19:00:00 +0000

Type	Values Removed	Values Added
Description		If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
Title		Unexpected paths returned from LookPath in os/exec
References		https://go.dev/cl/691775 https://go.dev/issue/74466 https://groups.google.com/g/golang-announce/c/x5MKroML2yM https://pkg.go.dev/vuln/GO-2025-3956

MITRE

Status: PUBLISHED

Assigner: Go

Published: 2025-09-18T18:41:11.847Z

Updated: 2025-09-18T20:42:38.389Z

Reserved: 2025-05-13T23:31:29.596Z

Link: CVE-2025-47906

Vulnrichment

Updated: 2025-09-18T20:42:34.381Z

NVD

Status : Received

Published: 2025-09-18T19:15:37.660

Modified: 2025-09-18T21:15:47.920

Link: CVE-2025-47906

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-47906", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2025-05-13T23:31:29.596Z", "datePublished": "2025-09-18T18:41:11.847Z", "dateUpdated": "2025-09-18T20:42:38.389Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2025-09-18T18:41:11.847Z"}, "title": "Unexpected paths returned from LookPath in os/exec", "descriptions": [{"lang": "en", "value": "If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (\"\", \".\", and \"..\"), can result in the binaries listed in the PATH being unexpectedly returned."}], "affected": [{"vendor": "Go standard library", "product": "os/exec", "collectionURL": "https://pkg.go.dev", "packageName": "os/exec", "versions": [{"version": "0", "lessThan": "1.23.12", "status": "affected", "versionType": "semver"}, {"version": "1.24.0", "lessThan": "1.24.6", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "LookPath"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-115: Misinterpretation of Input"}]}], "references": [{"url": "https://go.dev/cl/691775"}, {"url": "https://go.dev/issue/74466"}, {"url": "https://groups.google.com/g/golang-announce/c/x5MKroML2yM"}, {"url": "https://pkg.go.dev/vuln/GO-2025-3956"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-09-18T20:42:17.936162Z", "id": "CVE-2025-47906", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-18T20:42:38.389Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-47906", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-18T20:42:17.936162Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-18T20:42:34.381Z"}}], "cna": {"title": "Unexpected paths returned from LookPath in os/exec", "affected": [{"vendor": "Go standard library", "product": "os/exec", "versions": [{"status": "affected", "version": "0", "lessThan": "1.23.12", "versionType": "semver"}, {"status": "affected", "version": "1.24.0", "lessThan": "1.24.6", "versionType": "semver"}], "packageName": "os/exec", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "LookPath"}]}], "references": [{"url": "https://go.dev/cl/691775"}, {"url": "https://go.dev/issue/74466"}, {"url": "https://groups.google.com/g/golang-announce/c/x5MKroML2yM"}, {"url": "https://pkg.go.dev/vuln/GO-2025-3956"}], "descriptions": [{"lang": "en", "value": "If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (\"\", \".\", and \"..\"), can result in the binaries listed in the PATH being unexpectedly returned."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-115: Misinterpretation of Input"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2025-09-18T18:41:11.847Z"}}}, "cveMetadata": {"cveId": "CVE-2025-47906", "state": "PUBLISHED", "dateUpdated": "2025-09-18T20:42:38.389Z", "dateReserved": "2025-05-13T23:31:29.596Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2025-09-18T18:41:11.847Z", "assignerShortName": "Go"}, "dataVersion": "5.1"}