CVE-2025-22873

Unscored

Advisory

Published 4 Feb 2026In the index since 5 Sept 2026

Severity: Unscored; worst across findings
CVSS: —; base score, highest
EPSS: 0.002; 16th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,738; of 17,803 indexed, latest versions
Container images: 3,322; deployed by those charts
Fix available: 1 of 1; affected package

Improper access to parent directory of root in os

Carried by container images the latest versions of 2,738 of 17,803 indexed charts deploy, on 3,322 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+152 more	1.23.9	3,322

OSV records: GO-2026-4403
Also known as: BIT-golang-2025-22873

Charts affected

2,738 by stars

Chart

Latest

Affected images

Radar Score

ceph-csi-cephfswikimedia

0.1.8

5 of 5 See more

ceph-csi-cephfs wikimedia 0.1.8

5 of the 5 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
gcr.io/k8s-staging-sig-storage/csi-provisioner :v3.2.1	4ad5fcdbe7e9	stdlib@go1.18	1.23.9
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	stdlib@go1.18.5	1.23.9
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.5.1	0103eee7c35e	stdlib@go1.17.3	1.23.9
registry.k8s.io/sig-storage/csi-resizer :v1.5.0	8f7520bd957e	stdlib@go1.18	1.23.9
registry.k8s.io/sig-storage/csi-snapshotter :v6.0.1	ad16874e2140	stdlib@go1.18	1.23.9

Open the chart page →

10,333

ceph-csi-rbdwikimedia

0.1.13

6 of 6 See more

ceph-csi-rbd wikimedia 0.1.13

6 of the 6 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
gcr.io/k8s-staging-sig-storage/csi-provisioner :v3.2.1	4ad5fcdbe7e9	stdlib@go1.18	1.23.9
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	stdlib@go1.18.5	1.23.9
registry.k8s.io/sig-storage/csi-attacher :v3.5.0	dd245051317e	stdlib@go1.18	1.23.9
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.5.1	0103eee7c35e	stdlib@go1.17.3	1.23.9
registry.k8s.io/sig-storage/csi-resizer :v1.5.0	8f7520bd957e	stdlib@go1.18	1.23.9
registry.k8s.io/sig-storage/csi-snapshotter :v6.0.1	ad16874e2140	stdlib@go1.18	1.23.9

Open the chart page →

11,839

jaegerwikimedia

3.1.2

4 of 4 See more

jaeger wikimedia 3.1.2

4 of the 4 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-agent :1.53.0	0214a0ef24b1	stdlib@go1.21.5	1.23.9
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	stdlib@go1.18.2	1.23.9
jaegertracing/jaeger-collector :1.53.0	7f1269222903	stdlib@go1.21.5	1.23.9
jaegertracing/jaeger-query :1.53.0	049bb0d64ea3	stdlib@go1.21.5	1.23.9

Open the chart page →

9,354

opentelemetry-collectorwikimedia

0.62.7

1 of 1 See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.81.0	c6671841470b	stdlib@go1.20.5	1.23.9

Open the chart page →

2,034

wireguardwireguard-bananas

1.5.0

1 of 1 See more

wireguard wireguard-bananas 1.5.0

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
place1/wg-access-server :v0.4.6	2b2f3ea80ed6	stdlib@go1.13.8	1.23.9

Open the chart page →

2,752

csi-driver-host-pathwiremind

0.1.1

8 of 8 See more

csi-driver-host-path wiremind 0.1.1

8 of the 8 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-attacher :v4.0.0	9a685020911e	stdlib@go1.18	1.23.9
registry.k8s.io/sig-storage/csi-external-health-monitor-controller :v0.7.0	80b9ba94aa2a	stdlib@go1.18	1.23.9
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.6.0	f1c25991bac2	stdlib@go1.18	1.23.9
registry.k8s.io/sig-storage/csi-provisioner :v3.3.0	ee3b525d5b89	stdlib@go1.18	1.23.9
registry.k8s.io/sig-storage/csi-resizer :v1.6.0	425d8f1b7693	stdlib@go1.18	1.23.9
registry.k8s.io/sig-storage/csi-snapshotter :v6.1.0	291334908ddf	stdlib@go1.18	1.23.9
registry.k8s.io/sig-storage/hostpathplugin :v1.9.0	92257881c1d6	stdlib@go1.18	1.23.9
registry.k8s.io/sig-storage/livenessprobe :v2.8.0	cacee2b5c36d	stdlib@go1.18	1.23.9

Open the chart page →

12,663

dex-k8s-authenticatorwiremind

1.7.0

1 of 1 See more

dex-k8s-authenticator wiremind 1.7.0

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
mintel/dex-k8s-authenticator :1.4.0	caf71cee7b9a	stdlib@go1.13.11	1.23.9

Open the chart page →

2,792

druid-tasks-exporterwiremind

0.3.0

1 of 1 See more

druid-tasks-exporter wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
ghcr.io/wiremind/druid-tasks-exporter :v0.4.0	4755c3fcd5f0	stdlib@go1.21.4	1.23.9

Open the chart page →

533

koherencewiremind

0.4.1

1 of 1 See more

koherence wiremind 0.4.1

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
ghcr.io/wiremind/koherence :v0.2.3	9c2afc45c55d	stdlib@go1.22.3	1.23.9

Open the chart page →

426

postgres-operatorwiremind

1.14.0-wiremind0

1 of 1 See more

postgres-operator wiremind 1.14.0-wiremind0

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
ghcr.io/zalando/postgres-operator :v1.14.0	4f40cfc2283b	stdlib@go1.23.4	1.23.9

Open the chart page →

1,431

prometheus-openstack-exporterwiremind

0.5.0

1 of 1 See more

prometheus-openstack-exporter wiremind 0.5.0

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
ghcr.io/openstack-exporter/openstack-exporter :1.7.0	e5146a7dd515	stdlib@go1.18.10	1.23.9

Open the chart page →

1,480

prometheus-safety-exporterwiremind

0.6.0

1 of 2 See more

prometheus-safety-exporter wiremind 0.6.0

1 of the 2 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
quay.io/prometheuscommunity/json-exporter :v0.7.0	3a777171d39a	stdlib@go1.23.6	1.23.9

Open the chart page →

725

registrywiremind

0.1.1

1 of 1 See more

registry wiremind 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
ghcr.io/distribution/distribution :3.0.0	4ba3adf47f5c	stdlib@go1.23.7	1.23.9

Open the chart page →

1,357

silence-operatorwiremind

0.0.8

1 of 1 See more

silence-operator wiremind 0.0.8

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
giantswarm/silence-operator :0.13.0	a6cac55aa2d4	stdlib@go1.24.1	1.23.9

Open the chart page →

934

kafka-connect-uiwitcom-gmbh

0.5.0

1 of 2 See more

kafka-connect-ui witcom-gmbh 0.5.0

1 of the 2 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.3.0	8c21390be87d	stdlib@go1.17.10	1.23.9

Open the chart page →

2,513

mrtg-backendwitcom-gmbh

0.7.0

1 of 2 See more

mrtg-backend witcom-gmbh 0.7.0

1 of the 2 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.2.1	febeebebe762	stdlib@go1.17.5	1.23.9

Open the chart page →

2,623

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	stdlib@go1.20.12	1.23.9

Open the chart page →

14,226

workadventureworkadventure

1.1.0

6 of 9 See more

workadventure workadventure 1.1.0

6 of the 9 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
matthiasluedtke/iconserver :v3.16.0	661d607b0fbc	stdlib@go1.21.1	1.23.9
thecodingmachine/workadventure-back :v1.17.7	64001369dad5	stdlib@go1.20.7	1.23.9
thecodingmachine/workadventure-ejabberd :v1.17.7	01df99622ad3	stdlib@go1.17.13	1.23.9
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	stdlib@go1.19.3	1.23.9
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	stdlib@go1.20.7	1.23.9
thecodingmachine/workadventure-uploader :v1.17.7	3ccd467543b3	stdlib@go1.20.7	1.23.9

Open the chart page →

16,096

commentopluspluswyrihaximusnet

0.4.0

1 of 1 See more

commentoplusplus wyrihaximusnet 0.4.0

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
caroga/commentoplusplus :v1.8.7	f3233882b3bd	stdlib@go1.15.15	1.23.9

Open the chart page →

1,960

oauth2xd

1.0.0

1 of 1 See more

2,008

owlxd

0.5.1

2 of 2 See more

owl xd 0.5.1

2 of the 2 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
lishimeng/owl-console :v0.11.2	c79a67657baf	stdlib@go1.21.3	1.23.9
lishimeng/owl-messager :v0.11.2	3d00485e64dc	stdlib@go1.21.3	1.23.9

Open the chart page →

4,110

passportxd

0.2.16

2 of 2 See more

passport xd 0.2.16

2 of the 2 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
lishimeng/passport :v0.2.16	3e7d05ded625	stdlib@go1.20.7	1.23.9
lishimeng/passport-profile :v0.2.16	0970dfe5dc8f	stdlib@go1.20.7	1.23.9

Open the chart page →

3,976

tabbyxd

1.0.6

1 of 2 See more

7,672

treexd

0.1.10

1 of 1 See more

1,998

zooxd

0.4.0

1 of 1 See more

2,070

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	stdlib@go1.22.8	1.23.9

Open the chart page →

13,875

pgbounceryasn77-pgbouncer

0.0.8

1 of 1 See more

pgbouncer yasn77-pgbouncer 0.0.8

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
ghcr.io/yasn77/pgbouncer :v0.0.6	cc8c13550e44	stdlib@go1.18.6	1.23.9

Open the chart page →

1,152

ygdrassil-monitoringygdrassil

0.4.0

7 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

7 of the 10 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	stdlib@go1.23.5	1.23.9
prom/alertmanager :v0.28.0	d5155cfac40a	stdlib@go1.23.4	1.23.9
quay.io/prometheus-operator/prometheus-config-reloader :v0.79.2	193280a33bc1	stdlib@go1.23.4	1.23.9
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.23.9
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	stdlib@go1.23.4	1.23.9
quay.io/prometheus/pushgateway :v1.11.0	99392035ae99	stdlib@go1.23.4	1.23.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	stdlib@go1.23.3	1.23.9

Open the chart page →

9,426

prometheusalertygqygq2

1.0.0

1 of 1 See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	stdlib@go1.20.6	1.23.9

Open the chart page →

1,610

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	stdlib@go1.18.1	1.23.9

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	stdlib@go1.17.8	1.23.9
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	stdlib@go1.17.9	1.23.9
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	stdlib@go1.16	1.23.9
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	stdlib@go1.16	1.23.9

Open the chart page →

8,000

nginx-vts-exporterymrs

0.1.2

1 of 1 See more

nginx-vts-exporter ymrs 0.1.2

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
sophos/nginx-vts-exporter :latest	f1073556b29b	stdlib@go1.13.6	1.23.9

Open the chart page →

1,337

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	stdlib@go1.15.2	1.23.9

Open the chart page →

3,024

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	stdlib@go1.20.4	1.23.9
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	stdlib@go1.20.4	1.23.9

Open the chart page →

5,076

zahori-moonzahori

1.0.1

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	stdlib@go1.20.4	1.23.9
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	stdlib@go1.20.4	1.23.9
quay.io/aerokube/moon-ui :2.0.5	89990b146824	stdlib@go1.20.5	1.23.9

Open the chart page →

2,908

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.23.9

Open the chart page →

2,477

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	stdlib@go1.17.13	1.23.9

Open the chart page →

3,700

zookeeper-exporterzookeeper-exporter

0.1.0

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.23.9

Open the chart page →

1,248

Container images carrying it

3,322 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
grafana/logcli :main-c90366d-amd64	3d85bb66e39b	stdlib@go1.16.2	1.23.9	1
grafana/loki :2.9.10	35b02acc6765	stdlib@go1.22.5	1.23.9	1
grafana/loki :2.9.2	6074e01dbe03	stdlib@go1.21.3	1.23.9	1
grafana/loki :2.9.6	6ca6e2cd3b6f	stdlib@go1.21.3	1.23.9	1
grafana/loki :3.0.0	757b5fadf816	stdlib@go1.21.9	1.23.9	1
grafana/loki :2.0.0	77e138f81a8e	stdlib@go1.14.2	1.23.9	1
grafana/loki :3.2.0	882e30c20683	stdlib@go1.22.7	1.23.9	1
grafana/loki :3.3.2	8af2de1abbdd	stdlib@go1.23.4	1.23.9	1
grafana/loki :2.8.2	b1da1d23037e	stdlib@go1.20.4	1.23.9	1
grafana/loki :2.4.2	b3af8ead67d7	stdlib@go1.17.2	1.23.9	1
grafana/loki-canary :3.0.0	28d7c00588aa	stdlib@go1.21.9	1.23.9	1
grafana/loki-canary :3.1.0	39baf6d67f85	stdlib@go1.22.2	1.23.9	1
grafana/loki-canary :2.9.2	4249db29b992	stdlib@go1.21.3	1.23.9	1
grafana/loki-canary :3.2.0	49e03f80d361	stdlib@go1.22.7	1.23.9	1
grafana/loki-canary :2.9.6	549a40203e97	stdlib@go1.21.3	1.23.9	1
grafana/loki-canary :2.6.1	ab2a2569307b	stdlib@go1.17.9	1.23.9	1
grafana/mimir :r292-5f01872	7476e456c738	stdlib@go1.22.3	1.23.9	1
grafana/mimir :2.0.0	80c1a8eb24dd	stdlib@go1.17.8	1.23.9	1
grafana/mimir :2.15.0	85f55510e0d3	stdlib@go1.23.2	1.23.9	1
grafana/otel-lgtm :0.11.10	09d8c3ce4f3a	stdlib@go1.24.1	1.23.9	1
grafana/phlare :0.5.1	330f990cdad9	stdlib@go1.19.6	1.23.9	1
grafana/promtail :2.6.1	072527b12cdf	stdlib@go1.17.9	1.23.9	1
grafana/promtail :2.0.0	5fd12edcc694	stdlib@go1.14.2	1.23.9	1
grafana/promtail :2.9.10	63a2e57a5b14	stdlib@go1.22.5	1.23.9	1
grafana/promtail :2.7.0	c16c710f7333	stdlib@go1.19.2	1.23.9	1
grafana/promtail :3.0.0	d3de3da9431c	stdlib@go1.21.9	1.23.9	1
grafana/pyroscope :1.10.0	319bf32ae06b	stdlib@go1.22.7	1.23.9	1
grafana/rollout-operator :v0.14.0	3409edfb45c7	stdlib@go1.22.1	1.23.9	1
grafana/snyk_exporter :v1.4.1	d3c9093401ca	stdlib@go1.21.0	1.23.9	1
grafana/tempo :2.6.0	f55a8a1937ff	stdlib@go1.22.6	1.23.9	1
graphiteapp/graphite-statsd :1.1.7-6	04a0037cc2ae	stdlib@go1.13.11	1.23.9	1
graphprotocol/graph-node :v0.37.0	f4452cdedd68	stdlib@go1.24.1	1.23.9	1
gresearch/armada-operator :latest	6c43743e2b2d	stdlib@go1.24.0	1.23.9	1
gresearch/fasttrackml :latest	16d1228220fc	stdlib@go1.21.10	1.23.9	1
groundnuty/k8s-wait-for :v1.6	84edcf796267	stdlib@go1.18.1	1.23.9	1
groundnuty/k8s-wait-for :no-root-v2.0	a26d3d3f6e1c	stdlib@go1.19.3	1.23.9	1
grpl/grapple-cli :0.2.127	c00aafee6629	stdlib@go1.18.10	1.23.9	1
gutmensch/podnat-controller :0.5.2	566979793fc4	stdlib@go1.22.3	1.23.9	1
haproxytech/haproxy-alpine :2.6.6	14e4afa90dfd	stdlib@go1.19.3	1.23.9	1
haproxytech/haproxy-alpine :2.9.5	7f3dc8c7e031	stdlib@go1.22.0	1.23.9	1
haproxytech/haproxy-alpine :2.8.0	8951be4b4e1c	stdlib@go1.20.5	1.23.9	1
haproxytech/kubernetes-ingress :1.11.4	c5f8a41ef0d4	stdlib@go1.22.2	1.23.9	1
hashicorp/boundary :0.15.3	339b78b61750	stdlib@go1.21.8	1.23.9	1
hashicorp/boundary :0.8.1	fb70bd9210ff	stdlib@go1.17.10	1.23.9	1
hashicorp/consul :1.17.0	712fe02d2f84	stdlib@go1.20.10	1.23.9	1
hashicorp/consul :1.15.3	ddff34041c5c	stdlib@go1.20.4	1.23.9	1
hashicorp/consul-k8s-control-plane :1.3.0	0e4452f0f265	stdlib@go1.20.10	1.23.9	1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	stdlib@go1.20.4	1.23.9	1
hashicorp/terraform :1.4	4dcb45513699	stdlib@go1.19.6	1.23.9	1
hashicorp/terraform :1.9.7	b77efab1a448	stdlib@go1.22.7	1.23.9	1