CVE-2025-22873

What it actually does

The vulnerability allows a process to bypass a directory restriction implemented using Go's os.Root. By crafting a filename that ends with "../", an attacker can access the immediate parent directory of the intended root. This is a limited path traversal, allowing only the listing or reading of the parent directory itself, but not its ancestors or other files contained within it. This constitutes a sandbox escape, granting low-impact information disclosure outside the intended boundary.

Why it matters to the business

Applications that rely on Go's os.Root for sandboxing file system access may be vulnerable to information disclosure. An attacker with local access could potentially read the contents of a directory one level above the intended "root," which might expose sensitive configuration files, environment variables, or other internal system details. This could lead to further attacks or a minor data breach, depending on what information is stored in the parent directory. The impact is low due to the limited nature of the traversal and the requirement for local access.

How an attack unfolds

An attacker with low-privileged local access to a system running a vulnerable Go application would first identify a part of the application that uses os.Root to restrict file system access, such as a file upload feature or a web server serving static files from a specific directory. The attacker would then craft a request or input that includes a filename ending in "../". When the vulnerable Go code attempts to open this file using os.Root.Open(), it will incorrectly resolve the path and instead open the parent directory of the intended root. This allows the attacker to list the contents of that parent directory, revealing sensitive information that was supposed to be inaccessible.

How to fix it

The vulnerability is fixed in the Go standard library. Developers should update their Go toolchain and recompile their applications. For users of pre-compiled software, apply the vendor-supplied patches. Specifically, users of cilium-envoy-fips-1.16 on MinimOS should upgrade to version 1.16.17-r0 or later. Developers using Go should ensure their projects are built with a version of Go that includes the fix, which corresponds to commit f77084d15d53e6aa09d2e7f867e69cc9766da2c5 or later releases incorporating this commit.

How to confirm the fix worked

To validate the fix, check the version of the Go compiler used to build the application and the versions of any affected third-party packages. For source code, audit any calls to os.Root.Open() and attempt to pass a filename ending in "../". A patched system should prevent access to the parent directory and return an error. For binary analysis, check the version of linked libraries or the application itself against the fixed versions provided by vendors. For example, on a system with cilium-envoy-fips-1.16, verify the installed version is 1.16.17-r0 or newer.

Typical attack path

1. An attacker with low-privileged local access identifies a vulnerable Go application that uses os.Root for sandboxing.
2. The attacker crafts an input containing a path that ends with the sequence "../".
3. The attacker submits this input to a function within the application that performs a file open operation.
4. The vulnerable application code calls os.Root.Open() with the malicious path, bypassing the directory restriction.
5. The attacker successfully reads the contents of the parent directory of the intended sandboxed root, leading to information disclosure.

How to detect it

Detecting exploitation of this vulnerability can be difficult as it may appear as legitimate, albeit unusual, file access. Monitor application logs for file open operations that include "../" at the end of a path string. Look for anomalous process behavior where a sandboxed process attempts to access files or directories outside its designated root. If file access auditing is enabled (e.g., via auditd on Linux), search for open or openat syscalls from the sandboxed process that target paths outside the intended jail, particularly the immediate parent directory.

• %../"%
• "../"

What your security team should do

• Use a Software Composition Analysis (SCA) tool to identify all applications in your environment built with vulnerable Go versions and prioritize them for patching.
• Prioritize patching for any internet-facing or multi-tenant systems built with vulnerable versions of Go, as they are at higher risk of being used in an exploit chain.
• Review security-critical applications that rely on os.Root for containment and ensure they are patched promptly, as the vulnerability represents a sandbox escape, despite its low severity score.