CVE-2025-22873

Unscored

Advisory

Published 4 Feb 2026In the index since 5 Sept 2026

Severity: Unscored; worst across findings
CVSS: —; base score, highest
EPSS: 0.002; 16th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,862; of 17,828 indexed, latest versions
Container images: 3,425; deployed by those charts
Fix available: 1 of 1; affected package

Improper access to parent directory of root in os

Carried by container images the latest versions of 2,862 of 17,828 indexed charts deploy, on 3,425 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+154 more	1.23.9	3,425

OSV records: GO-2026-4403
Also known as: BIT-golang-2025-22873

Charts affected

2,862 by stars

Chart

Latest

Affected images

Radar Score

pgbounceryasn77-pgbouncer

0.0.8

1 of 1 See more

pgbouncer yasn77-pgbouncer 0.0.8

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
ghcr.io/yasn77/pgbouncer :v0.0.6	cc8c13550e44	stdlib@go1.18.6	1.23.9

Open the chart page →

1,153

ygdrassil-monitoringygdrassil

0.4.0

7 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

7 of the 10 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	stdlib@go1.23.5	1.23.9
prom/alertmanager :v0.28.0	d5155cfac40a	stdlib@go1.23.4	1.23.9
quay.io/prometheus-operator/prometheus-config-reloader :v0.79.2	193280a33bc1	stdlib@go1.23.4	1.23.9
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.23.9
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	stdlib@go1.23.4	1.23.9
quay.io/prometheus/pushgateway :v1.11.0	99392035ae99	stdlib@go1.23.4	1.23.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	stdlib@go1.23.3	1.23.9

Open the chart page →

9,530

prometheusalertygqygq2

1.0.0

1 of 1 See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	stdlib@go1.20.6	1.23.9

Open the chart page →

1,611

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	stdlib@go1.18.1	1.23.9

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	stdlib@go1.17.8	1.23.9
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	stdlib@go1.17.9	1.23.9
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	stdlib@go1.16	1.23.9
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	stdlib@go1.16	1.23.9

Open the chart page →

8,003

nginx-vts-exporterymrs

0.1.2

1 of 1 See more

nginx-vts-exporter ymrs 0.1.2

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
sophos/nginx-vts-exporter :latest	f1073556b29b	stdlib@go1.13.6	1.23.9

Open the chart page →

1,337

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	stdlib@go1.15.2	1.23.9

Open the chart page →

3,025

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	stdlib@go1.20.4	1.23.9
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	stdlib@go1.20.4	1.23.9

Open the chart page →

5,077

zahori-moonzahori

1.0.1

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	stdlib@go1.20.4	1.23.9
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	stdlib@go1.20.4	1.23.9
quay.io/aerokube/moon-ui :2.0.5	89990b146824	stdlib@go1.20.5	1.23.9

Open the chart page →

2,908

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.23.9

Open the chart page →

2,482

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	stdlib@go1.17.13	1.23.9

Open the chart page →

3,702

zookeeper-exporterzookeeper-exporter

0.1.0

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.23.9

Open the chart page →

1,249

Container images carrying it

3,425 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
inaccel/mkrt :latest	187fd448b6f2	stdlib@go1.21.5	1.23.9	2
inaccel/reef :latest	c967218739f3	stdlib@go1.21.6	1.23.9	2
iomesh/csi-node-driver-registrar :v2.5.0	86f58b0a2106	stdlib@go1.17.3	1.23.9	2
iomesh/csi-provisioner :v3.0.0	f9508460b273	stdlib@go1.16.2	1.23.9	2
iomesh/csi-snapshotter :v6.2.2	becc53e25b96	stdlib@go1.19	1.23.9	2
iomesh/hostpath-provisioner :v0.5.1	f4878c8ae53a	stdlib@go1.13.1	1.23.9	2
iomesh/livenessprobe :v2.8.0	560f01510f99	stdlib@go1.18	1.23.9	2
iomesh/localpv-manager :v0.2.0	f13deacac3f4	stdlib@go1.20.3	1.23.9	2
iomesh/node-disk-exporter :1.8.0	f03148764f38	stdlib@go1.14.7	1.23.9	2
iomesh/snapshot-controller :v6.2.2	fb95b65bb88f	stdlib@go1.19	1.23.9	2
iomesh/zookeeper-operator :0.2.15	9b38b5c7a61d	stdlib@go1.19.7	1.23.9	2
ipfs/kubo :v0.33.2	1a30f5ed8579	stdlib@go1.23.6	1.23.9	2
istio/install-cni :1.24.2-distroless	aef4825e110f	stdlib@go1.23.2	1.23.9	2
istio/pilot :1.24.2-distroless	137e44e3d1d2	stdlib@go1.23.2	1.23.9	2
istio/proxyv2 :1.18.0	757d28c24100	stdlib@go1.20.4	1.23.9	2
istio/proxyv2 :1.10.3	a78b7a165744	stdlib@go1.16.6	1.23.9	2
jaegertracing/all-in-one :1.31	04d224a9999b	stdlib@go1.17.6	1.23.9	2
jenkins/jenkins :2.426.1-jdk11	b470bcdc4ecd	stdlib@go1.20.6	1.23.9	2
jettech/kube-webhook-certgen :v1.2.1	c42098c8d855	stdlib@go1.13.11	1.23.9	2
jettech/kube-webhook-certgen :v1.5.0	fb7c2cd46ccf	stdlib@go1.15.3	1.23.9	2
jmalloc/echo-server :0.3.1	e4eaee2c7998	stdlib@go1.17	1.23.9	2
k0sproject/k0s :v1.26.0-k0s.0	f04635825d51	stdlib@go1.19.4	1.23.9	2
kbudde/rabbitmq-exporter :1.0.0 :latest	12f27d6d84e6	stdlib@go1.21.8	1.23.9	2
kubernetesui/dashboard :v2.2.0	148991563e37	stdlib@go1.15.1	1.23.9	2
kubespheredev/kube-webhook-certgen :v1.1.1	23a03c9c381f	stdlib@go1.16.9	1.23.9	2
lachlanevenson/k8s-kubectl :v1.25.4	af5cea3f2e40	stdlib@go1.19.3	1.23.9	2
langgenius/dify-sandbox :0.2.0	09b7e8705673	stdlib@go1.20.6	1.23.9	2
library/arangodb :3.11.8	1e75d74954a4	stdlib@go1.21.5	1.23.9	2
library/cassandra :4.1.3	7cbcec0086ac	stdlib@go1.18.2	1.23.9	2
library/influxdb :2.6.1-alpine	44a366dd7724	stdlib@go1.19.4	1.23.9	2
library/influxdb :2.7	b8d940ca9376	stdlib@go1.18.2	1.23.9	2
library/mariadb :10.8.3	0abf60f81588	stdlib@go1.16.7	1.23.9	2
library/mariadb :10.10	334b315c10e5	stdlib@go1.18.2	1.23.9	2
library/mariadb :11.3.2	e101f9db3191	stdlib@go1.18.2	1.23.9	2
library/mysql :8.2.0	212fe73edca5	stdlib@go1.18.2	1.23.9	2
library/mysql :8.4.2	ac80b6e09e5b	stdlib@go1.18.2	1.23.9	2
library/nats :2.9.17-alpine	1a7b320b2942	stdlib@go1.19.9	1.23.9	2
library/nats :2.10.7-alpine	1bcddab51b80	stdlib@go1.21.5	1.23.9	2
library/nats :2.10.5-alpine	85319e5e541b	stdlib@go1.21.4	1.23.9	2
library/nats :2.8.4-alpine	988010f74b61	stdlib@go1.17.10	1.23.9	2
library/postgres :16.1	09f23e02d766	stdlib@go1.18.2	1.23.9	2
library/postgres :16.2	4aea012537ed	stdlib@go1.18.2	1.23.9	2
library/postgres :9.6	caddd35b05cd	stdlib@go1.16.7	1.23.9	2
library/postgres :16.4	e62fbf9d3e2b	stdlib@go1.18.2	1.23.9	2
library/rabbitmq :4.1.0-management	935b3f84c1e4	stdlib@go1.22.2	1.23.9	2
library/rabbitmq :4.3.5-management :4-management :management	ffd1b50c522a	stdlib@go1.22.2	1.23.9	2
library/redis	148bb5411c18	stdlib@go1.18.2	1.23.9	2
library/redis :7.2.3	a7cee7c8178f	stdlib@go1.18.2	1.23.9	2
library/traefik :v2.5	7d5a6ae66572	stdlib@go1.17.6	1.23.9	2
library/traefik :2.4.8	eda951fd29a8	stdlib@go1.16.2	1.23.9	2