CVE-2025-47906: Unexpected paths returned from LookPath in os/exec
Published Aug 6, 2025
·Updated
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
Affected Software
4 affected components
Google Go<1.24.6, <1.23.12
Golang Go<1.23.12
Golang Go>=1.24.0<1.24.6
IBM Concert Software<=1.0.0-2.2.0
Remediation
Patch Available
Event History
Sep 18, 2025
CVE Published
via MITRE·06:41 PM
Data Sourced
via MITRE·06:41 PM
DescriptionWeakness
Data Sourced
via Red Hat·07:01 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·07:15 PM
RemedyDescriptionSeverityAffected Software
Mar 23, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-47906?
CVE-2025-47906 is classified as a medium severity vulnerability.
2
How do I fix CVE-2025-47906?
To mitigate CVE-2025-47906, ensure that the PATH environment variable contains only directory paths and exclude executable files.
3
Which versions of Google Go are affected by CVE-2025-47906?
CVE-2025-47906 affects Google Go versions up to 1.24.6 and 1.23.12.
4
What are the potential impacts of CVE-2025-47906?
If exploited, CVE-2025-47906 can lead to unexpected behavior when certain strings are passed to LookPath.
5
Is there a patch available for CVE-2025-47906?
Yes, upgrading to a version of Google Go beyond 1.24.6 or 1.23.12 will resolve the vulnerability.