BIT-golang-2025-47906

vendorUSosv

Unexpected paths returned from LookPath in os/exec

view advisory published 2025-09-20Licence: per source

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-47906US	—	0.55% (45th)	—	2025-09-18
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the bin…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2025/08/06/1REPORT
https://go.dev/cl/691775FIX
https://go.dev/issue/74466ADVISORY
https://groups.google.com/g/golang-announce/c/x5MKroML2yMDISCUSSION
https://nvd.nist.gov/vuln/detail/CVE-2025-47906WEB
https://pkg.go.dev/vuln/GO-2025-3956ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan