CVE-2025-0913: Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall
os.OpenFile(path, os.OCREATE|OEXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with OCREATE and OEXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the OCREATE and OEXCL flags are both set and the target path is a symlink.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
golang/goto a version that resolves this vulnerability.Fixed in 1.24.4Patch CVE-2025-4673 - Upgrade
Upgrade
golang/goto a version that resolves this vulnerability.Fixed in 1.24.4Patch CVE-2025-0913 - Upgrade
Upgrade
golang/goto a version that resolves this vulnerability.Fixed in 1.24.4Patch CVE-2025-22874 - Upgrade
Upgrade
golang/goto a version that resolves this vulnerability.Fixed in 1.23.10Patch CVE-2025-4673 - Upgrade
Upgrade
golang/goto a version that resolves this vulnerability.Fixed in 1.23.10Patch CVE-2025-0913 - Upgrade
Upgrade
golang/goto a version that resolves this vulnerability.Fixed in 1.23.10Patch CVE-2025-22874 - Configuration
After upgrading to the fixed Go versions, OpenFile must always return an error when both O_CREATE and O_EXCL are set and the target path is a symlink (including dangling symlinks), eliminating inconsistent Unix/Windows behavior.
Go os.OpenFile (os package) Behavior when using os.O_CREATE|os.O_EXCL on symlink path = Return an error instead of creating a file
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0913?
CVE-2025-0913 has a medium severity rating due to its implications on file operations across different operating systems.
How do I fix CVE-2025-0913?
To fix CVE-2025-0913, ensure your Go application properly handles symlinks across different operating systems.
What platforms are affected by CVE-2025-0913?
CVE-2025-0913 affects applications running on both Unix and Windows operating systems.
What are the implications of CVE-2025-0913?
The implications of CVE-2025-0913 include potential file handling errors when working with dangling symlinks.
Which version of Go is vulnerable to CVE-2025-0913?
CVE-2025-0913 impacts specific versions of the Go programming language that utilize the os.OpenFile function.