Vulnerability · Published Jun 11, 2025 · Assigned by Go
CVE-2025-0913Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall
Medium 5.5
In plain English
A medium-severity security flaw in os from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | go | 1.24.4-r0 | ALPINE-CVE-2025-0913 |
| Alpine:v3.23 | go | 1.24.4-r0 | ALPINE-CVE-2025-0913 |
| Alpine:v3.24 | go | 1.24.4-r0 | ALPINE-CVE-2025-0913 |
| Go | stdlib | 1.23.10, 1.24.4 | GO-2025-3750 |
| Ubuntu:22.04:LTS | golang-1.13 | no fix listed | UBUNTU-CVE-2025-0913 |
| Ubuntu:22.04:LTS | golang-1.17 | no fix listed | UBUNTU-CVE-2025-0913 |
| Ubuntu:22.04:LTS | golang-1.18 | no fix listed | UBUNTU-CVE-2025-0913 |
| Ubuntu:22.04:LTS | golang-1.20 | no fix listed | UBUNTU-CVE-2025-0913 |
| Ubuntu:22.04:LTS | golang-1.21 | no fix listed | UBUNTU-CVE-2025-0913 |
| Ubuntu:24.04:LTS | golang-1.21 | no fix listed | UBUNTU-CVE-2025-0913 |
| Ubuntu:22.04:LTS | golang-1.22 | no fix listed | UBUNTU-CVE-2025-0913 |
| Ubuntu:24.04:LTS | golang-1.22 | no fix listed | UBUNTU-CVE-2025-0913 |
| Ubuntu:22.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2025-0913 |
| Ubuntu:24.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2025-0913 |
| Ubuntu:25.10 | golang-1.23 | no fix listed | UBUNTU-CVE-2025-0913 |
| Ubuntu:26.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2025-0913 |
| Ubuntu:22.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2025-0913 |
| Ubuntu:24.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2025-0913 |
| Ubuntu:25.10 | golang-1.24 | no fix listed | UBUNTU-CVE-2025-0913 |
| Ubuntu:26.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2025-0913 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | syscall | 0 – before 1.23.101.24.0-0 – before 1.24.4 |
| Go standard library | os | 0 – before 1.23.101.24.0-0 – before 1.24.4 |