It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

An update of the go package has been released.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - It was possible to improperly access the parent directory of an os.Root by opening a filename ending in
    "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits
    opening the parent directory itself, not ancestors of the parent or files contained within the parent.
    (CVE-2025-22873)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - It was possible to improperly access the parent directory of an os.Root by opening a filename ending in     ../. For example, Root.Open(../) would open the parent directory of the Root. This escape only permits     opening the parent directory itself, not ancestors of the parent or files contained within the parent.
    (CVE-2025-22873)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01846-1 advisory.

    go1.24.4 (released 2025-06-05) includes security fixes to the     crypto/x509, net/http, and os packages, as well as bug fixes to     the linker, the go command, and the hash/maphash and os packages.
    ( bsc#1236217 go1.24 release tracking CVE-2025-22874 CVE-2025-0913 CVE-2025-4673)

    * CVE-2025-22874: crypto/x509: ExtKeyUsageAny bypasses policy validation (bsc#1244158)
    * CVE-2025-0913: os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows (bsc#1244157)
    * CVE-2025-4673: net/http: sensitive headers not cleared on cross-origin redirect (bsc#1244156)
    * os: Root.Mkdir creates directories with zero permissions on OpenBSD
    * hash/maphash: hashing channels with purego impl. of maphash.Comparable panics
    * runtime/debug: BuildSetting does not document DefaultGODEBUG
    * cmd/go: add fips140 module selection mechanism
    * cmd/link: Go 1.24.3 and 1.23.9 regression - duplicated definition of symbol dlopen
    * CVE-2025-22873: os: Root permits access to parent directory

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-977 advisory.

    A directory traversal vulnerability was discovered in the Go programming language's os package in versions     prior to 1.24.3. The vulnerability allows improper access to the parent directory of an os.Root by opening     a filename ending in ../. When exploited, this vulnerability permits an attacker to open the parent     directory of the Root, though it does not allow access to ancestors of the parent or files contained     within the parent directory. This issue has been fixed in Go 1.24.3, where Root now correctly returns an     error when such access is attempted. (CVE-2025-22873)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01551-1 advisory.

    Update to go1.24.3 (bsc#1236217):

    Security fixes:

     - CVE-2025-22873: Fixed os.Root permits access to parent directory (bsc#1242715)

    Changelog:

     * go#73556 go#73555 security: fix CVE-2025-22873 os: Root permits access to parent directory
     * go#73082 os: Root.Open panics when opening a symlink referencing the root
     * go#73092 cmd/link: linkname directive on userspace variable can override runtime variable
     * go#73118 crypto/tls: ECH decodeInnerClientHello incorrectly rejects ClientHello with GREASE values in     supportedVersions
     * go#73144 runtime: segmentation fault from vgetrandomPutState and runtime.growslice w/     runtime.OSLockThread
     * go#73192 runtime: -race data race map traceback report incorrect functions
     * go#73281 cmd/compile: program compiles to wasm but is invalid: go:wasmexport: integer too large
     * go#73379 runtime, x/sys/unix: Connectx is broken on darwin/amd64
     * go#73440 cmd/compile: infinite loop in the inliner
     * go#73500 cmd/go: +dirty in version stamping doesn't combine well with +incompatible

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1551-1 advisory.

    Update to go1.24.3 (bsc#1236217):

    Security fixes:

     - CVE-2025-22873: Fixed os.Root permits access to parent directory (bsc#1242715)

    Changelog:

     * go#73556 go#73555 security: fix CVE-2025-22873 os: Root permits access to parent directory
     * go#73082 os: Root.Open panics when opening a symlink referencing the root
     * go#73092 cmd/link: linkname directive on userspace variable can override runtime variable
     * go#73118 crypto/tls: ECH decodeInnerClientHello incorrectly rejects ClientHello with GREASE values in     supportedVersions
     * go#73144 runtime: segmentation fault from vgetrandomPutState and runtime.growslice w/     runtime.OSLockThread
     * go#73192 runtime: -race data race map traceback report incorrect functions
     * go#73281 cmd/compile: program compiles to wasm but is invalid: go:wasmexport: integer too large
     * go#73379 runtime, x/sys/unix: Connectx is broken on darwin/amd64
     * go#73440 cmd/compile: infinite loop in the inliner
     * go#73500 cmd/go: +dirty in version stamping doesn't combine well with +incompatible

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Golang running on the remote host is 1.24.x prior to 1.24.3. It is, therefore, affected by a directory traversal vulnerability that makes it possible to improperly access the parent directory of an os.Root.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
320798	Photon OS 5.0: Go PHSA-2026-5.0-0869	Nessus	PhotonOS Local Security Checks	medium
437533	Golang: stdlib: security update to 1.23.9stdlib: security update to 1.24.3	Tenable Cloud Security	Golang	low
437533	Golang: stdlib: security update to 1.23.9stdlib: security update to 1.24.3	Tenable Self-Hosted Container Security	Golang	low
259902	Linux Distros Unpatched Vulnerability : CVE-2025-22873	Nessus	Misc.	low
238043	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.24 (SUSE-SU-2025:01846-1)	Nessus	SuSE Local Security Checks	high
237671	Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2025-977)	Nessus	Amazon Linux Local Security Checks	medium
427787	Alpine: multiple go packages: security update to 1.24.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	low
427787	Alpine: multiple go packages: security update to 1.24.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	low
237541	SUSE SLED15 / SLES15 Security Update : go1.24 (SUSE-SU-2025:01551-1)	Nessus	SuSE Local Security Checks	medium
427712	Alpine: multiple go packages: security update to 1.23.9-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	low
427712	Alpine: multiple go packages: security update to 1.23.9-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	low
236789	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.24 (SUSE-SU-2025:1551-1)	Nessus	SuSE Local Security Checks	medium
235470	Golang 1.24.x < 1.24.3 Directory Traversal	Nessus	Misc.	high

Detections

Analytics

CVE-2025-22873

low

Tenable Plugins

medium

low

low

low

high

medium

low

low

medium

low

low

medium

high