GO-2025-3750

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2025-3750

Import Source

https://vuln.go.dev/ID/GO-2025-3750.json

JSON Data

https://api.test.osv.dev/v1/vulns/GO-2025-3750

Aliases

Published

2025-06-11T16:59:06Z

Modified

2025-06-14T06:44:23.967481Z

Summary

Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall

Details

os.OpenFile(path, os.OCREATE|OEXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with OCREATE and OEXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the OCREATE and OEXCL flags are both set and the target path is a symlink.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2025-3750"
}

References

Credits

- Junyoung Park and Dong-uk Kim of KAIST Hacking Lab

Affected packages

Go / stdlib

Package

Name: stdlib; View open source insights on deps.dev
Purl: pkg:golang/stdlib

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.23.10

Introduced

1.24.0-0

Fixed

1.24.4

Ecosystem specific

{
    "imports": [
        {
            "symbols": [
                "Open"
            ],
            "path": "syscall",
            "goos": [
                "windows"
            ]
        },
        {
            "symbols": [
                "Chdir",
                "Chmod",
                "Chown",
                "CopyFS",
                "Create",
                "CreateTemp",
                "File.ReadDir",
                "File.Readdir",
                "File.Readdirnames",
                "Getwd",
                "Lchown",
                "Link",
                "Lstat",
                "Mkdir",
                "MkdirAll",
                "MkdirTemp",
                "NewFile",
                "Open",
                "OpenFile",
                "OpenInRoot",
                "OpenRoot",
                "Pipe",
                "ReadDir",
                "ReadFile",
                "Remove",
                "RemoveAll",
                "Rename",
                "Root.Create",
                "Root.Lstat",
                "Root.Mkdir",
                "Root.Open",
                "Root.OpenFile",
                "Root.OpenRoot",
                "Root.Remove",
                "Root.Stat",
                "StartProcess",
                "Stat",
                "Symlink",
                "Truncate",
                "WriteFile",
                "dirFS.Open",
                "dirFS.ReadDir",
                "dirFS.ReadFile",
                "dirFS.Stat",
                "rootFS.Open",
                "rootFS.ReadDir",
                "rootFS.ReadFile",
                "rootFS.Stat",
                "unixDirent.Info"
            ],
            "path": "os",
            "goos": [
                "windows"
            ]
        }
    ]
}