{"action":"Upgrade go to 1.23.9-r0 or later.","affected":[{"introduced":"1.24.0"}],"component":"go","cve_ids":[],"ecosystem":"Alpine","ecosystem_qualifier":"Alpine:v3.21","exploited":false,"fixed_versions":["1.23.9-r0"],"id":"tcs_01M6H15DEM1ZH2K69AMQKPNTPJ","modified_at":"2026-11-03T06:32:51.777579385Z","published_at":"2026-02-04T23:15:54.220Z","references":["https://osv.dev/vulnerability/ALPINE-CVE-2025-22873","https://security.alpinelinux.org/vuln/CVE-2025-22873"],"severity":{"label":"low","score":3.8},"sources":[{"source":"osv","source_id":"ALPINE-CVE-2025-22873","url":"https://osv.dev/vulnerability/ALPINE-CVE-2025-22873"}],"summary":"It was possible to improperly access the parent directory of an os.Root by opening a filename ending in \"../\". For example, Root.Open(\"../\") would open the parent directory of the Root. This escape on"}