{"id":"EUVD-2025-30195","revision":"deef7b65b415423ebbdbda6227797bab","records":[{"revision":"deef7b65b415423ebbdbda6227797bab","observedAt":"2026-10-27T22:48:50.85+00:00","statement":{"source":"euvd","id":"EUVD-2025-30195","aliases":["CVE-2025-47906","GHSA-gwrf-jf3h-w649"],"title":"If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (\"\", \".\", and \"..\"), can result in the binaries listed in the PATH being unexpectedly returned.","description":"If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (\"\", \".\", and \"..\"), can result in the binaries listed in the PATH being unexpectedly returned.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","score":6.5,"severity":null}],"references":["https://go.dev/cl/691775","https://go.dev/issue/74466","https://groups.google.com/g/golang-announce/c/x5MKroML2yM","https://pkg.go.dev/vuln/GO-2025-3956"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-30195","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 18, 2025, 6:41:11 PM","dateUpdated":"Nov 4, 2025, 9:10:54 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2025:02759-1","title":"Security update for go1.23","vulnerabilityIds":["CVE-2025-47906","CVE-2025-47907"]},{"id":"RHSA-2026:3462","title":"Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (ROCm)","vulnerabilityIds":["CVE-2023-48022","CVE-2023-52355","CVE-2023-52356","CVE-2024-56433","CVE-2025-5318","CVE-2025-6242","CVE-2025-6965","CVE-2025-8176","CVE-2025-9230","CVE-2025-9714","CVE-2025-9900","CVE-2025-15467","CVE-2025-22868","CVE-2025-22869","CVE-2025-47906","CVE-2025-52565","CVE-2025-53905","CVE-2025-53906","CVE-2025-59375","CVE-2025-59425","CVE-2025-61620","CVE-2025-62164","CVE-2025-62372","CVE-2025-62426","CVE-2025-62593","CVE-2025-62727","CVE-2025-66418","CVE-2025-66448","CVE-2025-66471","CVE-2025-66506","CVE-2025-69223","CVE-2026-0994","CVE-2026-21441","CVE-2026-22773","CVE-2026-22778","CVE-2026-22807","CVE-2026-24049","CVE-2026-24486","CVE-2026-24779","CVE-2026-25990"]},{"id":"RHSA-2025:22004","title":"Red Hat Security Advisory: go-rpm-macros security update","vulnerabilityIds":["CVE-2025-47906"]},{"id":"msrc_CVE-2025-47906","title":"Unexpected paths returned from LookPath in os/exec","vulnerabilityIds":["CVE-2025-47906"]},{"id":"SUSE-SU-2025:02760-1","title":"Security update for go1.24","vulnerabilityIds":["CVE-2025-47906","CVE-2025-47907"]},{"id":"RHSA-2026:3461","title":"Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (CUDA)","vulnerabilityIds":["CVE-2023-48022","CVE-2023-52355","CVE-2023-52356","CVE-2024-56433","CVE-2025-5318","CVE-2025-6242","CVE-2025-6965","CVE-2025-8176","CVE-2025-9230","CVE-2025-9714","CVE-2025-9900","CVE-2025-15467","CVE-2025-22868","CVE-2025-22869","CVE-2025-47906","CVE-2025-52565","CVE-2025-53905","CVE-2025-53906","CVE-2025-59375","CVE-2025-59425","CVE-2025-61620","CVE-2025-62164","CVE-2025-62372","CVE-2025-62426","CVE-2025-62593","CVE-2025-62727","CVE-2025-66418","CVE-2025-66448","CVE-2025-66471","CVE-2025-66506","CVE-2025-69223","CVE-2026-0994","CVE-2026-21441","CVE-2026-22773","CVE-2026-22778","CVE-2026-22807","CVE-2026-24049","CVE-2026-24486","CVE-2026-24779","CVE-2026-25990"]},{"id":"openSUSE-SU-2025:15423-1","title":"go1.24-1.24.6-1.1 on GA media","vulnerabilityIds":["CVE-2025-47906","CVE-2025-47907"]},{"id":"WID-SEC-W-2025-1837","title":"Gitea: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2025-47906","CVE-2025-47907"]},{"id":"SUSE-SU-2025:03161-1","title":"Security update for go1.25-openssl","vulnerabilityIds":["CVE-2025-4674","CVE-2025-47906","CVE-2025-47907"]},{"id":"SUSE-SU-2026:0298-1","title":"Security update for go1.25-openssl","vulnerabilityIds":["CVE-2025-4674","CVE-2025-47906","CVE-2025-47907","CVE-2025-47910","CVE-2025-47912","CVE-2025-58183","CVE-2025-58185","CVE-2025-58186","CVE-2025-58187","CVE-2025-58188","CVE-2025-58189","CVE-2025-61723","CVE-2025-61724","CVE-2025-61725","CVE-2025-61726","CVE-2025-61727","CVE-2025-61728","CVE-2025-61729","CVE-2025-61730","CVE-2025-61731","CVE-2025-68119","CVE-2025-68121"]},{"id":"SUSE-SU-2025:03115-1","title":"Security update for go1.25-openssl","vulnerabilityIds":["CVE-2025-4674","CVE-2025-47906","CVE-2025-47907"]},{"id":"SUSE-SU-2025:03158-1","title":"Security update for go1.24-openssl","vulnerabilityIds":["CVE-2025-0913","CVE-2025-22874","CVE-2025-4673","CVE-2025-4674","CVE-2025-47906","CVE-2025-47907"]},{"id":"openSUSE-SU-2025:15420-1","title":"go1.25-1.25rc3-1.1 on GA media","vulnerabilityIds":["CVE-2025-47906","CVE-2025-47907"]},{"id":"RHSA-2025:22935","title":"Red Hat Security Advisory: Red Hat Update Infrastructure 5 security update","vulnerabilityIds":["CVE-2025-47906","CVE-2025-59375"]},{"id":"RHSA-2025:21856","title":"Red Hat Security Advisory: golang security update","vulnerabilityIds":["CVE-2025-47906","CVE-2025-58183"]},{"id":"RHSA-2025:13941","title":"Red Hat Security Advisory: golang security update","vulnerabilityIds":["CVE-2025-4674","CVE-2025-47906","CVE-2025-47907"]},{"id":"RHSA-2025:23733","title":"Red Hat Security Advisory: go-toolset:rhel8 security update","vulnerabilityIds":["CVE-2025-47906","CVE-2025-58183"]},{"id":"SUSE-SU-2025:02812-1","title":"Security update for go1.23-openssl","vulnerabilityIds":["CVE-2025-4674","CVE-2025-47906","CVE-2025-47907"]},{"id":"openSUSE-SU-2025:15422-1","title":"go1.23-1.23.12-1.1 on GA media","vulnerabilityIds":["CVE-2025-47906","CVE-2025-47907"]},{"id":"RHSA-2025:13935","title":"Red Hat Security Advisory: golang security update","vulnerabilityIds":["CVE-2025-4674","CVE-2025-47906","CVE-2025-47907"]},{"id":"WID-SEC-W-2025-1740","title":"Golang Go: Mehrere Schwachstellen ermöglichen Manipulation von Dateien","vulnerabilityIds":["CVE-2025-47906","CVE-2025-47907"]},{"id":"SUSE-SU-2025:03159-1","title":"Security update for go1.23-openssl","vulnerabilityIds":["CVE-2024-45336","CVE-2024-45341","CVE-2025-0913","CVE-2025-22866","CVE-2025-22870","CVE-2025-22871","CVE-2025-4673","CVE-2025-4674","CVE-2025-47906","CVE-2025-47907"]},{"id":"RHSA-2025:22899","title":"Red Hat Security Advisory: golang security update","vulnerabilityIds":["CVE-2025-47906","CVE-2025-58183"]},{"id":"SUSE-SU-2025:02924-1","title":"Security update for go1.25","vulnerabilityIds":["CVE-2025-4674","CVE-2025-47906","CVE-2025-47907"]},{"id":"RHSA-2025:23851","title":"Red Hat Security Advisory: go-rpm-macros security update","vulnerabilityIds":["CVE-2025-47906"]},{"id":"openSUSE-SU-2025:15566-1","title":"govulncheck-vulndb-0.0.20250918T182144-1.1 on GA media","vulnerabilityIds":["CVE-2025-47906","CVE-2025-5187"]},{"id":"RHSA-2025:23741","title":"Red Hat Security Advisory: go-toolset:rhel8 security update","vulnerabilityIds":["CVE-2025-47906","CVE-2025-58183"]},{"id":"RHSA-2025:23833","title":"Red Hat Security Advisory: go-rpm-macros security update","vulnerabilityIds":["CVE-2025-47906"]},{"id":"SUSE-SU-2026:0297-1","title":"Security update for go1.25-openssl","vulnerabilityIds":["CVE-2025-4674","CVE-2025-47906","CVE-2025-47907","CVE-2025-47910","CVE-2025-47912","CVE-2025-58183","CVE-2025-58185","CVE-2025-58186","CVE-2025-58187","CVE-2025-58188","CVE-2025-58189","CVE-2025-61723","CVE-2025-61724","CVE-2025-61725","CVE-2025-61726","CVE-2025-61727","CVE-2025-61728","CVE-2025-61729","CVE-2025-61730","CVE-2025-61731","CVE-2025-68119","CVE-2025-68121"]},{"id":"RHSA-2025:23737","title":"Red Hat Security Advisory: go-toolset:rhel8 security update","vulnerabilityIds":["CVE-2025-47906","CVE-2025-58183"]},{"id":"RHSA-2025:23834","title":"Red Hat Security Advisory: go-rpm-macros security update","vulnerabilityIds":["CVE-2025-47906"]},{"id":"RHSA-2025:22005","title":"Red Hat Security Advisory: go-rpm-macros security update","vulnerabilityIds":["CVE-2025-47906"]},{"id":"RHSA-2025:23205","title":"Red Hat Security Advisory: Red Hat AI Inference Server 3.2.5 (ROCm)","vulnerabilityIds":["CVE-2025-9230","CVE-2025-9714","CVE-2025-22868","CVE-2025-22869","CVE-2025-47906","CVE-2025-52565","CVE-2025-59375","CVE-2025-62164","CVE-2025-62372","CVE-2025-66448","CVE-2025-66506"]},{"id":"RHSA-2025:23449","title":"Red Hat Security Advisory: Red Hat AI Inference Server 3.2.5 (ROCm)","vulnerabilityIds":["CVE-2025-9230","CVE-2025-9714","CVE-2025-22868","CVE-2025-22869","CVE-2025-47906","CVE-2025-52565","CVE-2025-59375","CVE-2025-62164","CVE-2025-62372","CVE-2025-66448","CVE-2025-66506"]},{"id":"RHSA-2026:19350","title":"Red Hat Security Advisory: git-lfs security update","vulnerabilityIds":["CVE-2024-45341","CVE-2025-4673","CVE-2025-47906","CVE-2026-25679","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-33810"]},{"id":"RHSA-2025:23740","title":"Red Hat Security Advisory: go-toolset:rhel8 security update","vulnerabilityIds":["CVE-2025-47906","CVE-2025-58183"]},{"id":"RHSA-2025:22668","title":"Red Hat Security Advisory: go-toolset:rhel8 security update","vulnerabilityIds":["CVE-2025-47906","CVE-2025-58183"]},{"id":"openSUSE-SU-2025:15586-1","title":"kubecolor-0.5.2-1.1 on GA media","vulnerabilityIds":["CVE-2025-0913","CVE-2025-47906"]},{"id":"RHSA-2025:22181","title":"Red Hat Security Advisory: golang security update","vulnerabilityIds":["CVE-2025-47906","CVE-2025-58183"]},{"id":"SUSE-SU-2025:02837-1","title":"Security update for go1.24-openssl","vulnerabilityIds":["CVE-2025-4674","CVE-2025-47906","CVE-2025-47907"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-30195","identifiers":["EUVD-2025-30195","CVE-2025-47906","GHSA-gwrf-jf3h-w649"]},"retained":false,"historicalAffected":[]}],"coverage":[]}