CVE-2025-0913: Golang Package Vulnerability in O_CREATE|O_EXCL Handling
Summary
CVE-2025-0913: Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall. Affects golang across 2 version ranges.
< 1.23.10
>= 1.24.0-0, < 1.24.4
Fixed in 1.23.10 or 1.24.4, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-0913 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, developed by Google, is an open-source programming language designed for simplicity and efficiency. It is widely used for building web servers, data pipelines, and other applications. The language's standard library includes the 'os' package, which provides a platform-independent interface to operating system functionality. However, a recent vulnerability has been identified in the way the 'os.OpenFile' function handles file creation flags, particularly on Unix and Windows systems.
Vulnerability Detail
The vulnerability arises from inconsistent handling of the O_CREATE|O_EXCL flags in the 'os.OpenFile' function when dealing with symlinks. On Unix systems, the function correctly avoids following symlinks when these flags are set. Conversely, on Windows, it creates a file at the symlink's target path even if that target does not exist. This discrepancy can lead to unexpected file creation, potentially allowing unauthorized access or data corruption. The issue has been addressed in version 1.24.0 of the Golang package, ensuring that an error is returned when the target path is a symlink with these flags set.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.23.101.23.10 -
>= 1.24.0-0, < 1.24.41.24.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot immediately update to the patched version, avoid using the O_CREATE|O_EXCL flags with symlinks in your code. Instead, check if the file exists before attempting to create it, using the following code snippet:
if _, err := os.Stat(path); os.IsNotExist(err) {
// File does not exist, safe to create
_, err := os.OpenFile(path, os.O_CREATE|os.O_EXCL, 0666)
if err != nil {
// Handle error
}
}
Conclusion
The CVE-2025-0913 vulnerability in the Golang package highlights the importance of consistent handling of file operations across different operating systems. By updating to the latest version or implementing workarounds, developers can mitigate the risks associated with this issue.
See every vulnerability recorded for golang →
FAQ
CVE-2025-0913 is a vulnerability in the Golang package related to inconsistent handling of file creation flags on Unix and Windows systems.
If your application uses the 'os.OpenFile' function with O_CREATE|O_EXCL flags and symlinks, it may create files unexpectedly, leading to potential data corruption or unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a temporary measure, avoid using the O_CREATE|O_EXCL flags with symlinks and implement a check to see if the file exists before creating it.
More information can be found in the official Golang repository and vulnerability databases that track CVE entries.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
