CVE-2025-22873

Unscored

Advisory

Published 4 Feb 2026In the index since 5 Sept 2026

Severity: Unscored; worst across findings
CVSS: —; base score, highest
EPSS: 0.002; 16th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,862; of 17,828 indexed, latest versions
Container images: 3,425; deployed by those charts
Fix available: 1 of 1; affected package

Improper access to parent directory of root in os

Carried by container images the latest versions of 2,862 of 17,828 indexed charts deploy, on 3,425 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+154 more	1.23.9	3,425

OSV records: GO-2026-4403
Also known as: BIT-golang-2025-22873

Charts affected

2,862 by stars

Chart

Latest

Affected images

Radar Score

pgbounceryasn77-pgbouncer

0.0.8

1 of 1 See more

pgbouncer yasn77-pgbouncer 0.0.8

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
ghcr.io/yasn77/pgbouncer :v0.0.6	cc8c13550e44	stdlib@go1.18.6	1.23.9

Open the chart page →

1,153

ygdrassil-monitoringygdrassil

0.4.0

7 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

7 of the 10 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	stdlib@go1.23.5	1.23.9
prom/alertmanager :v0.28.0	d5155cfac40a	stdlib@go1.23.4	1.23.9
quay.io/prometheus-operator/prometheus-config-reloader :v0.79.2	193280a33bc1	stdlib@go1.23.4	1.23.9
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.23.9
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	stdlib@go1.23.4	1.23.9
quay.io/prometheus/pushgateway :v1.11.0	99392035ae99	stdlib@go1.23.4	1.23.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	stdlib@go1.23.3	1.23.9

Open the chart page →

9,530

prometheusalertygqygq2

1.0.0

1 of 1 See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	stdlib@go1.20.6	1.23.9

Open the chart page →

1,611

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	stdlib@go1.18.1	1.23.9

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	stdlib@go1.17.8	1.23.9
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	stdlib@go1.17.9	1.23.9
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	stdlib@go1.16	1.23.9
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	stdlib@go1.16	1.23.9

Open the chart page →

8,003

nginx-vts-exporterymrs

0.1.2

1 of 1 See more

nginx-vts-exporter ymrs 0.1.2

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
sophos/nginx-vts-exporter :latest	f1073556b29b	stdlib@go1.13.6	1.23.9

Open the chart page →

1,337

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	stdlib@go1.15.2	1.23.9

Open the chart page →

3,025

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	stdlib@go1.20.4	1.23.9
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	stdlib@go1.20.4	1.23.9

Open the chart page →

5,077

zahori-moonzahori

1.0.1

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	stdlib@go1.20.4	1.23.9
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	stdlib@go1.20.4	1.23.9
quay.io/aerokube/moon-ui :2.0.5	89990b146824	stdlib@go1.20.5	1.23.9

Open the chart page →

2,908

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.23.9

Open the chart page →

2,482

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	stdlib@go1.17.13	1.23.9

Open the chart page →

3,702

zookeeper-exporterzookeeper-exporter

0.1.0

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-22873.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.23.9

Open the chart page →

1,249

Container images carrying it

3,425 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
library/traefik :2.2.8	f5af5a5ce17f	stdlib@go1.14.6	1.23.9	2
library/zookeeper :3.9.5	7d0f24ebb67b	stdlib@go1.18.1	1.23.9	2
lightninglabs/lnd :v0.18.3-beta	f86bbec4dfb3	stdlib@go1.22.5	1.23.9	2
linuxserver/cloud9 :latest :version-1.29.2	45c5fe102ff3	stdlib@go1.17.11	1.23.9	2
listmonk/listmonk :v2.1.0	d2eac77ddfad	stdlib@go1.17.6	1.23.9	2
longhornio/longhorn-manager :v1.2.3	dca34321452c	stdlib@go1.14.1	1.23.9	2
louislam/uptime-kuma :2.5.4	917318f9d7be	stdlib@go1.20.5	1.23.9	2
louislam/uptime-kuma :2.3.2	9aeb4e51d038	stdlib@go1.20.5	1.23.9	2
louislam/uptime-kuma :2.5.0	a8610b3b4c38	stdlib@go1.20.5	1.23.9	2
maxrocketinternet/soti-mobicontrol-exporter :0.6	1a281b76efa3	stdlib@go1.14	1.23.9	2
mesosphere/kubeaddons-catalog :v0.11.4	073db43d0b8b	stdlib@go1.15.2	1.23.9	2
natsio/nats-box :0.11.0	9fbf7bf684e4	stdlib@go1.18.1	1.23.9	2
natsio/nats-server-config-reloader :0.7.2	911ce7ed2f55	stdlib@go1.19	1.23.9	2
natsio/nats-server-config-reloader :0.10.1	e414cc7e6f59	stdlib@go1.19.4	1.23.9	2
natsio/prometheus-nats-exporter :0.10.0	16048afb67a5	stdlib@go1.19	1.23.9	2
natsio/prometheus-nats-exporter :0.17.3	26c826662ac8	stdlib@go1.24.2	1.23.9	2
natsio/prometheus-nats-exporter :0.11.0	31c02aac089a	stdlib@go1.20.3	1.23.9	2
oliver006/redis_exporter :v1.9.0	4af75e9f16f6	stdlib@go1.14.4	1.23.9	2
opencloudeu/opencloud-rolling :2.1.0	f9634bb04905	stdlib@go1.24.2	1.23.9	2
opendatacube/ows :latest	668cbb41473c	stdlib@go1.22.2	1.23.9	2
openkruise/kruise-helm-hook :v0.1.0	edc7cf9428fd	stdlib@go1.20.14	1.23.9	2
openpolicyagent/gatekeeper :v3.4.0-rc.1	825370bdb3c3	stdlib@go1.16.2	1.23.9	2
oryd/kratos :v1.0.0	d06fc5845f63	stdlib@go1.20.5	1.23.9	2
oryd/kratos :v1.3.1	fe2428f103a6	stdlib@go1.23.2	1.23.9	2
oryd/oathkeeper :v0.40.6	e8cb9b79a89c	stdlib@go1.20.5	1.23.9	2
osixia/openldap :1.4.0	ccd95cc6e61e	stdlib@go1.13.4	1.23.9	2
otel/opentelemetry-collector-contrib :0.96.0	7ef2a2ff46b9	stdlib@go1.21.7	1.23.9	2
otel/opentelemetry-collector-k8s :0.111.0	32b3c8296dcc	stdlib@go1.23.2	1.23.9	2
outlinewiki/outline :0.69.1	d060dcd8f9aa	stdlib@go1.19.4	1.23.9	2
passbolt/passbolt :3.4.0-ce-non-root	655547e17263	stdlib@go1.14.4	1.23.9	2
phntom/kochi :1.1.3	3b82358bd56e	stdlib@go1.15.5	1.23.9	2
place1/wg-access-server :v0.4.6	2b2f3ea80ed6	stdlib@go1.13.8	1.23.9	2
postgis/postgis :15-3.3	a2fc46b52819	stdlib@go1.18.2	1.23.9	2
pottava/s3-proxy :2.0	20a0bcb15f76	stdlib@go1.13.7	1.23.9	2
prom/blackbox-exporter :v0.18.0	1ffc3f109eb3	stdlib@go1.15.2	1.23.9	2
prom/prometheus :v2.17.2	42d2395cd719	stdlib@go1.13.10	1.23.9	2
prom/prometheus :v2.52.0	5c435642ca4d	stdlib@go1.22.3	1.23.9	2
prom/prometheus :v2.37.9	8176adea328e	stdlib@go1.19.11	1.23.9	2
prom/prometheus :v2.48.1	a67e5e402ff5	stdlib@go1.21.5	1.23.9	2
prom/prometheus :v2.21.0	d43417c260e5	stdlib@go1.15.2	1.23.9	2
prom/prometheus :v2.16.0	e4ca62c0d62f	stdlib@go1.13.8	1.23.9	2
prom/pushgateway :v1.3.0	c0d39b8d4cfe	stdlib@go1.15.2	1.23.9	2
qingcloud/cloud-controller-manager :v1.4.12	10f66b5df886	stdlib@go1.18.2	1.23.9	2
qingcloud/hostnic-plus :v1.0.3	4cd5366a9f51	stdlib@go1.16.3	1.23.9	2
rajnandan1/kener :3.2.19	30407afca731	stdlib@go1.20.7	1.23.9	2
rancher/k3s :v1.26.0-k3s1	9380f5dbae9a	stdlib@go1.19.4	1.23.9	2
rancher/kine :v0.11.4	12889bbcd1e8	stdlib@go1.21.5	1.23.9	2
rancher/local-path-provisioner :v0.0.29	9bebefa0b908	stdlib@go1.22.5	1.23.9	2
rclone/rclone :1.68	74c51b8817e5	stdlib@go1.23.3	1.23.9	2
ribbybibby/ssl-exporter :2.4.2	718abe7f5e79	stdlib@go1.18.3	1.23.9	2