CVE-2025-47906: go — Exploit & Fix

Description

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

Is your site exposed to CVE-2025-47906?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected Products

Vendor	Product	Versions
golang	go	< 1.23.12
golang	go	1.24.0 — 1.24.6

References

Advisories & Patches

https://go.dev/cl/691775 https://pkg.go.dev/vuln/GO-2025-3956

Exploits

https://go.dev/issue/74466

Other References

https://groups.google.com/g/golang-announce/c/x5MKroML2yM http://www.openwall.com/lists/oss-security/2025/08/06/1

Frequently Asked Questions

What is CVE-2025-47906? +

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2025-47906? +

CVE-2025-47906 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-47906? +

CVE-2025-47906 affects products from golang, specifically: go. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-47906? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-46595 10.0

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other …

CVE-2024-24790 9.8

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses …

CVE-2026-39834 9.1

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the …

CVE-2026-39833 9.1

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would …

CVE-2026-39832 9.1

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination …

CVE-2026-42508 9.1

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' …

CVE-2025-47906