CVE-2025-47906

Unexpected paths returned from LookPath in os/exec

Medium · published September 18, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00550 · 45.2th percentile
Published
2025-09-18T18:41Z
EPSS history
Timeline
  • 18 SEP 18:41Z
    Unexpected paths returned from LookPath in os/exec
    cvelistv5