CVE-2025-61731: Go cmd/go Path Traversal Vulnerability

CVE-2025-61731 Overview

CVE-2025-61731 is an Arbitrary File Write vulnerability affecting the Go programming language's cmd/go build tool. The vulnerability exists in how the #cgo pkg-config: directive processes command-line arguments. An attacker can craft a malicious Go source file containing a specially crafted cgo directive that injects a --log-file argument, causing pkg-config to write content to an attacker-controlled location on the filesystem.

Critical Impact

Attackers can achieve arbitrary file writes with partial content control by building malicious Go source files, potentially leading to code execution, configuration tampering, or privilege escalation.

Affected Products

• Go programming language (cmd/go build tool)
• Systems building untrusted Go source code with cgo enabled
• CI/CD pipelines processing external Go dependencies

Discovery Timeline

• 2026-01-28 - CVE-2025-61731 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2025-61731

Vulnerability Analysis

This vulnerability represents an input validation failure in the Go build system's handling of cgo directives. When processing Go source files that contain #cgo pkg-config: directives, the cmd/go tool passes the directive contents as command-line arguments to the system's pkg-config utility without adequate sanitization.

The fundamental issue is that pkg-config accepts a --log-file argument that instructs it to write output to a specified file path. Since the cgo directive allows arbitrary arguments to be passed through, an attacker can inject --log-file=/path/to/target to cause writes to arbitrary filesystem locations during the build process.

This attack requires local access, as the attacker must convince a user or build system to compile malicious Go source code. However, in modern development workflows involving automated dependency management and CI/CD pipelines, untrusted code may be built automatically, significantly expanding the attack surface.

Root Cause

The root cause is insufficient input validation and argument filtering in the cmd/go tool when processing #cgo pkg-config: directives. The implementation fails to sanitize or restrict dangerous command-line arguments before passing them to the external pkg-config process. This allows attackers to abuse pkg-config's legitimate logging functionality for malicious file write operations.

Attack Vector

The attack requires local access and involves creating a malicious Go source file with a specially crafted cgo directive. When a victim builds this file using go build or similar commands, the injected --log-file argument causes pkg-config to write to an attacker-specified location.

The attack is particularly concerning in scenarios involving:

• Building third-party or untrusted Go modules
• CI/CD systems that automatically fetch and build dependencies
• Development environments processing code from external sources

The attacker gains partial control over the file contents through pkg-config's log output, which may be sufficient for certain exploitation scenarios such as overwriting configuration files or injecting content into startup scripts.

Detection Methods for CVE-2025-61731

Indicators of Compromise

• Unexpected files appearing in system directories or sensitive locations after Go build operations
• Go source files containing suspicious #cgo pkg-config: directives with --log-file arguments
• Unusual pkg-config process activity writing to non-standard locations
• Modified configuration files or scripts with pkg-config log output artifacts

Detection Strategies

• Scan Go source files and dependencies for #cgo pkg-config: directives containing --log-file or other dangerous arguments
• Monitor file system activity during build operations for writes to unexpected locations
• Implement build-time scanning that flags cgo directives with potentially malicious argument patterns
• Review Go module dependencies for source files containing suspicious cgo configurations

Monitoring Recommendations

• Enable audit logging for file creation events during CI/CD build processes
• Monitor pkg-config process invocations for unusual command-line arguments
• Implement integrity monitoring on critical system files that could be targeted by arbitrary write attacks
• Track changes to Go source files in version control for newly introduced cgo directives

How to Mitigate CVE-2025-61731

Immediate Actions Required

• Update to the latest patched version of Go as indicated in the Golang Announcement
• Audit existing Go source files and dependencies for malicious #cgo pkg-config: directives
• Review build environments to identify systems that may have processed untrusted Go code
• Consider disabling cgo (CGO_ENABLED=0) for builds that don't require C interoperability

Patch Information

The Go team has addressed this vulnerability through code changes that sanitize pkg-config arguments. Technical details are available in the Go.dev Code Change and the Go.dev Issue Report. The official vulnerability advisory is published at Go.dev Vulnerability Advisory.

Organizations should update their Go installations to the latest patched version and rebuild any applications that may have been compiled with a vulnerable Go version using untrusted source code.

Workarounds

• Set CGO_ENABLED=0 environment variable to disable cgo entirely for builds that don't require C library integration
• Implement pre-build scanning to detect and block Go source files containing suspicious #cgo pkg-config: directives
• Run build processes in isolated containers or sandboxed environments with restricted filesystem access
• Manually review cgo directives in third-party dependencies before incorporating them into projects

# Disable cgo to prevent pkg-config directive exploitation
export CGO_ENABLED=0
go build ./...

# Alternative: Build in a restricted environment
# Use containers with read-only filesystems where possible