The vulnerability exists due to a flaw in the Go programming language's OS package, where the Root function fails to properly restrict access to parent directories. This allows processes with root privileges to bypass intended directory boundaries and access parent directories, violating expected security constraints.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01551-1 advisory.

    Update to go1.24.3 (bsc#1236217):

    Security fixes:

     - CVE-2025-22873: Fixed os.Root permits access to parent directory (bsc#1242715)

    Changelog:

     * go#73556 go#73555 security: fix CVE-2025-22873 os: Root permits access to parent directory
     * go#73082 os: Root.Open panics when opening a symlink referencing the root
     * go#73092 cmd/link: linkname directive on userspace variable can override runtime variable
     * go#73118 crypto/tls: ECH decodeInnerClientHello incorrectly rejects ClientHello with GREASE values in     supportedVersions
     * go#73144 runtime: segmentation fault from vgetrandomPutState and runtime.growslice w/     runtime.OSLockThread
     * go#73192 runtime: -race data race map traceback report incorrect functions
     * go#73281 cmd/compile: program compiles to wasm but is invalid: go:wasmexport: integer too large
     * go#73379 runtime, x/sys/unix: Connectx is broken on darwin/amd64
     * go#73440 cmd/compile: infinite loop in the inliner
     * go#73500 cmd/go: +dirty in version stamping doesn't combine well with +incompatible

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1551-1 advisory.

    Update to go1.24.3 (bsc#1236217):

    Security fixes:

     - CVE-2025-22873: Fixed os.Root permits access to parent directory (bsc#1242715)

    Changelog:

     * go#73556 go#73555 security: fix CVE-2025-22873 os: Root permits access to parent directory
     * go#73082 os: Root.Open panics when opening a symlink referencing the root
     * go#73092 cmd/link: linkname directive on userspace variable can override runtime variable
     * go#73118 crypto/tls: ECH decodeInnerClientHello incorrectly rejects ClientHello with GREASE values in     supportedVersions
     * go#73144 runtime: segmentation fault from vgetrandomPutState and runtime.growslice w/     runtime.OSLockThread
     * go#73192 runtime: -race data race map traceback report incorrect functions
     * go#73281 cmd/compile: program compiles to wasm but is invalid: go:wasmexport: integer too large
     * go#73379 runtime, x/sys/unix: Connectx is broken on darwin/amd64
     * go#73440 cmd/compile: infinite loop in the inliner
     * go#73500 cmd/go: +dirty in version stamping doesn't combine well with +incompatible

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Golang running on the remote host is 1.24.x prior to 1.24.3. It is, therefore, affected by a directory traversal vulnerability that makes it possible to improperly access the parent directory of an os.Root.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
237541	SUSE SLED15 / SLES15 Security Update : go1.24 (SUSE-SU-2025:01551-1)	Nessus	SuSE Local Security Checks	medium
236789	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.24 (SUSE-SU-2025:1551-1)	Nessus	SuSE Local Security Checks	medium
235470	Golang 1.24.x < 1.24.3 Directory Traversal	Nessus	Misc.	high

Detections

Analytics

CVE-2025-22873

medium

Tenable Plugins

medium

medium

high