GO-2026-4403
NoneCVSS
—
EPSS
—
Published
Feb 4, 2026
CISA due date
—
The record
Improper access to parent directory of root in os
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | stdlib | 0 | 1.23.9 |
Related vulnerabilities
- CVE-2025-22873 It was possible to improperly access the parent directory of an os.Root by opening a… Same vulnerability
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects stdlib
- CVE-2025-61726 The net/url package does not set a limit on the number of query parameters in a query. Also affects stdlib
- CVE-2025-61728 archive/zip uses a super-linear file name indexing algorithm that is invoked the first… Also affects stdlib
- CVE-2025-61730 During the TLS 1.3 handshake if multiple messages are sent in records that span… Also affects stdlib
- CVE-2025-61727 An excluded subdomain constraint in a certificate chain does not restrict the usage of… Also affects stdlib
- CVE-2025-61729 Within HostnameError.Error(), when constructing an error string, there is no limit to the… Also affects stdlib
- CVE-2025-61725 The ParseAddress function constructs domain-literal address components through repeated… Also affects stdlib