ALPINE-CVE-2025-22873

See a problem?
Please try reporting it to the source first.
Source
https://security.alpinelinux.org/vuln/CVE-2025-22873
Import Source
https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2025-22873.json
JSON Data
https://api.osv.dev/v1/vulns/ALPINE-CVE-2025-22873
Upstream
Published
2026-02-04T23:15:54Z
Modified
2026-11-03T06:32:51Z
Severity
  • 3.8 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

References

Affected packages

Alpine:v3.21 / go

Package

Name
go
Purl
pkg:apk/alpine/go?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.24.0
Fixed
1.23.9-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2025-22873.json"

Alpine:v3.22 / go

Package

Name
go
Purl
pkg:apk/alpine/go?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.24.0
Fixed
1.24.3-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2025-22873.json"

Alpine:v3.23 / go

Package

Name
go
Purl
pkg:apk/alpine/go?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.24.0
Fixed
1.24.3-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2025-22873.json"

Alpine:v3.24 / go

Package

Name
go
Purl
pkg:apk/alpine/go?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.24.0
Fixed
1.24.3-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2025-22873.json"