CVE-2025-22873: 
Go vulnerability analysis and mitigation

CVE-2025-22873 is a relative path traversal vulnerability in Go's os.Root functionality that allows improper access to the parent directory of a restricted root. By opening a filename ending in "../" (e.g., Root.Open("../")), an attacker can escape the intended directory boundary and access the parent directory itself. The vulnerability affects Go versions 1.24.0 through 1.24.2; Go 1.23.x releases are not affected. It carries a CVSS v3.1 base score of 3.8 (Low) (Feedly, oss-security).

The root cause is improper input validation in Go's os.Root API when processing filenames that end with the "../" sequence, classified as CWE-23 (Relative Path Traversal). When a caller invokes Root.Open("../"), the path traversal check fails to reject the trailing ../, allowing the operation to resolve to the parent directory of the configured root. The escape is limited strictly to opening the parent directory itself — it does not permit traversal to ancestors of the parent or access to files within the parent directory. The fix, applied in Go 1.24.3, causes Root to correctly return an error in this case (oss-security, Go Issue, Go Advisory).

Successful exploitation allows a local, low-privileged attacker to read the parent directory of a restricted os.Root, potentially exposing sensitive files or directory metadata stored outside the intended boundary. The confidentiality impact is low and scoped to the parent directory only; there is no integrity or availability impact. Applications that rely on os.Root for sandboxing or directory isolation (e.g., file servers, container runtimes, or multi-tenant services built in Go 1.24.x) are most at risk (Feedly, Go Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is extremely low at 0.005%, reflecting minimal exploitation probability. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and low privileges, limiting the practical attack surface (Feedly).

1. Identify target: Locate a Go application built with Go 1.24.0–1.24.2 that uses os.Root to restrict file access to a specific directory (e.g., a file server or sandboxed service).
2. Craft malicious path: Construct a filename argument ending in "../", such as Root.Open("../") or an equivalent API call that passes this string to the root-restricted file open function.
3. Submit request: Trigger the vulnerable code path — either directly (if the attacker controls input to the Go application) or via an exposed interface (e.g., an HTTP endpoint that accepts file paths).
4. Access parent directory: The os.Root boundary check fails to reject the trailing ../, and the parent directory handle is returned, allowing the attacker to enumerate or read directory metadata one level above the intended root (oss-security, Go Issue).

• Logs: Application logs showing file open requests with paths ending in "../" directed at os.Root-managed directories; unexpected directory listing or stat operations on parent directories.
• File System: Unusual access timestamps on parent directories of application-defined root paths, particularly if the application is not expected to traverse outside its root.
• Process: Go application processes accessing directories outside their configured root boundary, observable via strace/auditd syscall monitoring (e.g., openat calls resolving to parent directories).

Upgrade to Go 1.24.3 (or later), which contains the security fix for this vulnerability; Go 1.23.x is not affected and does not require an update. If immediate patching is not possible, review and restrict filesystem permissions on parent directories of any os.Root-managed paths to limit exposure to low-privilege processes. Downstream distributions including openSUSE, SUSE Linux, Arch Linux, Fedora, and Alpine Linux have released updated packages incorporating the fix (oss-security, Go Advisory, Go CL).

The Go team announced the fix via the golang-announce mailing list alongside the Go 1.24.3 and 1.23.9 releases. The vulnerability was reported by Dan Sebastian Thrane of SDU eScience Center. The official Go Bluesky account (golang.org) posted about the release, and the issue received routine coverage in Linux security advisory feeds (openSUSE, SUSE, Arch Linux, Fedora) and security aggregators. Community reaction was measured, consistent with the low severity rating and absence of active exploitation (oss-security).