CVE-2025-0913
Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall
os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.
Reserved 2025-01-30 | Published 2025-06-11 | Updated 2025-06-11 | Assigner GoCWE-59: Improper Link Resolution Before File Access ('Link Following')
Junyoung Park and Dong-uk Kim of KAIST Hacking Lab
groups.google.com/g/golang-announce/c/ufZ8WpEsA3A
Support options
