CVE-2025-47906

Unexpected paths returned from LookPath in os/exec

Published Sep 18, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-30195 If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
History
Type Values Removed Values Added
First Time appeared Golang go
Weaknesses NVD-CWE-Other
CPEs cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Vendors & Products Golang go
Type Values Removed Values Added
First Time appeared Golang
Golang lookpath
Vendors & Products Golang
Golang lookpath
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
Title Unexpected paths returned from LookPath in os/exec
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Go
Published
Updated
Nov 4, 2025, 9:10 PM
Reserved
May 13, 2025, 11:31 PM
Status
Analyzed
Published
Sep 18, 2025, 7:15 PM
Modified
Jun 17, 2026, 9:28 AM
Severity
Moderate
Public date
Sep 18, 2025, 6:41 PM