Vulnerability · Published Feb 19, 2026 · Assigned by mitre
CVE-2025-69725
Medium 4.7
In plain English
A medium-severity open redirect in the golang-github-go-chi-chi package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.3%top 82.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
An Open Redirect vulnerability in the go-chi/chi >=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | golang-github-go-chi-chi | 5.2.5-1 | DEBIAN-CVE-2025-69725 |
| Go | github.com/go-chi/chi | no fix listed | GO-2026-4316 |
| Go | github.com/go-chi/chi/v2 | no fix listed | GO-2026-4316 |
| Go | github.com/go-chi/chi/v3 | no fix listed | GO-2026-4316 |
| Go | github.com/go-chi/chi/v4 | no fix listed | GO-2026-4316 |
| Go | github.com/go-chi/chi/v5 | 5.2.4 | GO-2026-4316 |
| Go | github.com/go-chi/chi/v5 | 5.2.4 | GHSA-mqqf-5wvp-8fh8 |
| Ubuntu:22.04:LTS | golang-github-go-chi-chi | no fix listed | UBUNTU-CVE-2025-69725 |
| Ubuntu:24.04:LTS | golang-github-go-chi-chi | no fix listed | UBUNTU-CVE-2025-69725 |
| Ubuntu:25.10 | golang-github-go-chi-chi | no fix listed | UBUNTU-CVE-2025-69725 |
| Ubuntu:26.04:LTS | golang-github-go-chi-chi | no fix listed | UBUNTU-CVE-2025-69725 |
| Ubuntu:26.10 | golang-github-go-chi-chi | no fix listed | UBUNTU-CVE-2025-69725 |
Affected products (as reported)
Weakness: CWE-601 · Vector: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:C/UI:R