CVE-2025-0913: 
Go vulnerability analysis and mitigation

CVE-2025-0913 is a symlink-following vulnerability in the Go standard library's os.OpenFile() function, classified under CWE-59 (Improper Link Resolution Before File Access). On Windows systems, calling os.OpenFile(path, os.O_CREATE|os.O_EXCL) with a path pointing to a dangling symlink (a symlink targeting a nonexistent location) would incorrectly follow the symlink and create a file at the target location, contrary to the expected behavior on Unix systems where the call would fail. This cross-platform behavioral inconsistency was disclosed on June 11, 2025. Affected versions are Go before 1.23.10 and Go 1.24.0 through 1.24.3. The CVSS v3.1 base score is 5.5 (Medium) (Red Hat CVE, Go Vuln DB).

The root cause is improper symlink resolution (CWE-59) in Go's os and syscall packages on Windows. When O_CREATE and O_EXCL flags are used together, POSIX semantics require that the call fail if the path is a symlink — regardless of whether the symlink target exists — to prevent time-of-check/time-of-use (TOCTOU) race conditions. However, Go's Windows implementation did not enforce this, allowing a dangling symlink to be followed and a file to be created at the symlink's target path. The fix ensures OpenFile always returns an error when both O_CREATE and O_EXCL are set and the target path is a symlink, aligning Windows behavior with Unix semantics (Go Vuln DB, golang-announce). The attack vector is local, requires low privileges, and no user interaction (Red Hat CVE).

A local attacker with low privileges on a Windows system could exploit this vulnerability to create files in arbitrary locations by placing a dangling symlink in a path used by a Go application that calls os.OpenFile with O_CREATE|O_EXCL. This could lead to unauthorized file creation or modification, resulting in a high integrity impact. Confidentiality and availability are not directly affected, but unauthorized file placement could be leveraged for privilege escalation or persistent access in certain application contexts (Red Hat CVE, Go Vuln DB).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.012% (very low), reflecting the limited likelihood of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained to local access on Windows systems running vulnerable Go versions, significantly limiting the attack surface (Red Hat CVE, Go Vuln DB).

1. Reconnaissance: Identify a Windows system running a Go application (version < 1.23.10 or 1.24.0–1.24.3) that uses os.OpenFile with O_CREATE|O_EXCL flags on a user-controllable or predictable file path.
2. Create a dangling symlink: As a low-privileged local user, create a symbolic link at the path the target application is expected to write to, pointing to a nonexistent but attacker-desired location (e.g., a sensitive system directory or configuration file path).
3. Trigger file creation: Cause the vulnerable Go application to call os.OpenFile(symlinkPath, os.O_CREATE|os.O_EXCL, ...). On unpatched versions, the function follows the dangling symlink and creates a file at the symlink's target location instead of returning an error.
4. Achieve unauthorized file placement: The file is now created at the attacker-controlled target path, potentially overwriting or creating files in privileged locations, which could be leveraged for further privilege escalation or persistence (Go Vuln DB, golang-announce).

• File System: Unexpected files appearing in directories not normally written to by a Go application; dangling symlinks present in directories used by Go applications for file creation.
• Logs: Application logs showing successful file creation at unexpected paths; absence of expected error messages when O_CREATE|O_EXCL is used on symlink paths (on unpatched systems).
• Process: Go application processes creating files in sensitive or system directories without corresponding legitimate application activity.

Upgrade Go to version 1.23.10 or 1.24.4 (or later), which corrects the os.OpenFile behavior to always return an error when O_CREATE and O_EXCL are both set and the target path is a symlink on Windows. As a compensating control, applications can implement explicit symlink detection and path validation before calling os.OpenFile. Minimizing local user privileges on Windows systems running Go applications also reduces the exploitable attack surface (Go Vuln DB, golang-announce).

The Go team announced the fix via the golang-announce mailing list and the official Go vulnerability database. The vulnerability was also discussed on oss-security and noted in community CVE tracking feeds. Coverage has been moderate, appearing in Linux distribution security advisories (Mageia, openSUSE, Oracle Linux), vendor security bulletins (Red Hat, Splunk, Broadcom), and security news aggregators. No significant controversy or notable researcher commentary beyond standard patch advisories has been observed (golang-announce, SecurityOnline).