CVE-2025-0913: Golang Go Symlink Handling Vulnerability

CVE-2025-0913 Overview

CVE-2025-0913 is a Symlink Attack vulnerability in the Go programming language's standard library affecting Windows systems. The os.OpenFile() function exhibited inconsistent behavior between Unix and Windows platforms when handling dangling symlinks with the O_CREATE|O_EXCL flags. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks, providing secure behavior. However, on Windows, when the target path was a symlink pointing to a nonexistent location, OpenFile would create a file at that symlink destination, enabling potential symlink attacks.

Critical Impact

Applications using Go's os.OpenFile() with O_CREATE|O_EXCL flags on Windows could be tricked into creating files at unintended locations through symlink manipulation, potentially leading to arbitrary file write vulnerabilities.

Affected Products

• Golang Go (versions before the security patch)
• Microsoft Windows (as the affected operating system platform)
• Go applications deployed on Windows using os.OpenFile() with O_CREATE|O_EXCL flags

Discovery Timeline

• 2025-06-11 - CVE-2025-0913 published to NVD
• 2025-08-08 - Last updated in NVD database

Technical Details for CVE-2025-0913

Vulnerability Analysis

The vulnerability stems from a cross-platform behavioral inconsistency in Go's os.OpenFile() function when processing file creation with exclusive access flags. On Unix-like systems, the combination of O_CREATE (create file if it doesn't exist) and O_EXCL (fail if file exists) flags ensures that symlinks are never followed, providing an implicit protection against symlink-based attacks.

However, the Windows implementation did not maintain this same security guarantee. When a local attacker created a symlink pointing to a nonexistent path and a Go application attempted to create a file using the symlink as the target with O_CREATE|O_EXCL flags, Windows would follow the symlink and create the file at the symlink's destination rather than failing or creating the file at the symlink path itself.

This platform-specific behavior could be exploited to write files to arbitrary locations where the attacker has permission to create symlinks but not to directly write files, effectively bypassing file system access controls.

Root Cause

The root cause is the platform-dependent handling of symlinks in Go's file system abstraction layer for the os.OpenFile() function. The Unix implementation correctly refuses to follow symlinks when O_EXCL is specified, treating the symlink itself as the target. The Windows implementation lacked this symlink resolution check, causing it to dereference dangling symlinks before creating the file, leading to file creation at unintended locations.

Attack Vector

The attack vector requires local access to the system. An attacker must be able to create a symlink at a location where a vulnerable Go application will subsequently call os.OpenFile() with O_CREATE|O_EXCL flags. The attacker creates a symlink pointing to a target directory where they want the file to be written. When the Go application executes the file creation operation, it inadvertently creates the file at the symlink's destination rather than at the intended path.

This type of symlink attack (CWE-59) typically enables privilege escalation scenarios, configuration file tampering, or overwriting sensitive system files if the Go application runs with elevated privileges.

Detection Methods for CVE-2025-0913

Indicators of Compromise

• Unexpected symlinks appearing in directories where Go applications create files
• Files being created in unexpected locations by Go applications
• Suspicious symlink creation activity by non-privileged users targeting directories used by privileged Go services
• File system audit logs showing file creation events where the path differs from the application's intended target

Detection Strategies

• Audit Go application source code for usage of os.OpenFile() with O_CREATE|O_EXCL flag combinations on Windows deployments
• Monitor file system events for symlink creation followed by file write operations from Go binaries
• Implement file integrity monitoring on critical directories that may be targeted by symlink attacks
• Use static analysis tools to identify vulnerable code patterns in Go applications

Monitoring Recommendations

• Enable Windows file system auditing to track symlink creation events
• Configure application-level logging to record file creation paths and verify they match expected locations
• Implement endpoint detection rules for suspicious symlink activity patterns
• Review Go application logs for file operation failures that may indicate exploitation attempts

How to Mitigate CVE-2025-0913

Immediate Actions Required

• Update Go installations to the latest patched version that addresses this vulnerability
• Audit existing Go applications for use of os.OpenFile() with O_CREATE|O_EXCL flags on Windows
• Recompile and redeploy affected Go applications using the patched Go toolchain
• Restrict symlink creation permissions where possible on Windows systems hosting vulnerable applications

Patch Information

The Go team has released a fix that ensures os.OpenFile() now consistently returns an error when both O_CREATE and O_EXCL flags are set and the target path is a symlink, regardless of platform. Technical details of the fix are available in the Go.dev Change Log Entry. The vulnerability is tracked in the Go.dev Issue Discussion, and the official vulnerability report is documented as GO-2025-3750.

Workarounds

• Validate file paths before calling os.OpenFile() by checking if the path is a symlink using os.Lstat() and rejecting symlinks
• Implement application-level symlink detection before file creation operations
• Run Go applications with minimal necessary privileges to limit the impact of potential symlink attacks
• Use directory permissions to prevent untrusted users from creating symlinks in paths used by Go applications

# Check Go version and update to patched release
go version
# Update Go to the latest version containing the fix
# Rebuild affected applications
go build -o myapp ./cmd/myapp