CVE-2025-0913: falha de média gravidade em Go standard library syscall
Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.5epss 0.3%
os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVEs relacionadas — Go standard library syscall
No mesmo produto, das mais perigosas para as menos.
CVE-2022-41720HIGHRestricted file access on Windows in os and net/httpEPSS 1.3%CVE-2022-41716MEDIUMUnsanitized NUL in environment variables on Windows in syscall and os/execEPSS 1.0%CVE-2026-56857CRITICALRoot.Mkdir(All) can follow junctions out of the root on Windows in osEPSS 0.6%CVE-2025-22873LOWImproper access to parent directory of root in osEPSS 0.2%CVE-2026-39822HIGHRoot escape via symlink plus trailing slash in osEPSS 0.2%CVE-2026-27139LOWFileInfo can escape from a Root in osEPSS 0.2%