Cyber Resilience

CVE-2025-47906

Golang Go ≤ 1.23.12

Public PoC
Published
18 September 2025
Modified
27 January 2026
Patch / advisory
View advisory
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
EPSS Score 0.0049 39th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-47906 is a medium-severity an unspecified weakness vulnerability in Golang Go. Its CVSS base score is 6.5 (Medium).

Operationally, ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

CWE(s)
NVD-CWE-Other

Related Threats

CVEs Like This One

CVE-2026-32282Same product: Golang Go
CVE-2026-27138Same product: Golang Go
CVE-2023-29409Same product: Golang Go
CVE-2025-61727Same product: Golang Go
CVE-2025-4674Same product: Golang Go
CVE-2025-61723Same product: Golang Go
CVE-2026-27139Same product: Golang Go
CVE-2025-61724Same product: Golang Go
CVE-2026-42501Same product: Golang Go
CVE-2025-68121Same product: Golang Go

Affected Assets

golang
go
≤ 1.23.12 · 1.24.0 — 1.24.6

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • CM-6 Configuration Settings
  • AC-3 Access Enforcement
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of inputs to LookPath (rejecting "", ".", "..") so that a misconfigured PATH containing files cannot cause unexpected executable selection.

CM-6 Configuration Settings good match
prevent

Enforces secure configuration settings that restrict PATH to directories only, eliminating the prerequisite condition that allows the LookPath flaw to be triggered.

AC-3 Access Enforcement partial match
prevent

Enforces access-control decisions on resolved binaries, limiting the impact when LookPath unexpectedly returns an executable from a malformed PATH entry.

References