CVE-2025-61731: Golang Go Path Traversal Vulnerability

CVE-2025-61731 Overview

CVE-2025-61731 affects the Go toolchain's cmd/go build process. A malicious Go source file can leverage the #cgo pkg-config: directive to pass attacker-controlled arguments to the pkg-config command. By supplying --log-file, an attacker forces pkg-config to write to an arbitrary filesystem location with partial control of file content. The flaw is tracked upstream as GO-2026-4339 and mapped to CWE-88: Improper Neutralization of Argument Delimiters in a Command. Exploitation requires a developer or CI system to build the malicious source, making package supply chains and untrusted repositories the primary risk surface.

Critical Impact
Building an untrusted Go module can silently overwrite files accessible to the build user, enabling local privilege escalation, persistence, or corruption of CI/CD artifacts.

Affected Products

Golang Go toolchain (cmd/go) — versions prior to the fix in change CL 736711
Red Hat Enterprise Linux Go compiler packages (multiple RHSA errata; see Red Hat CVE-2025-61731 Advisory)
Any downstream distribution or container image shipping vulnerable Go builds

Discovery Timeline

2026-01-28 - CVE-2025-61731 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2025-61731

Vulnerability Analysis

The vulnerability resides in how cmd/go processes cgo preamble directives during compilation. When a Go source file contains a #cgo pkg-config: comment, the Go toolchain invokes the external pkg-config binary and forwards the directive's tokens as arguments. The toolchain does not sufficiently restrict which flags can be passed. An attacker who authors a malicious source file, module, or dependency can inject --log-file=/path/to/target, redirecting pkg-config diagnostic output into a file chosen by the attacker. Because pkg-config writes log entries containing portions of its own command line and package metadata, the attacker gains partial control of the resulting file content. This provides a primitive for writing shell configuration files, cron entries, or web root files under the build user's identity.

Root Cause

The root cause is argument injection [CWE-88] in the cgo directive parser. The parser treats directive tokens as opaque command-line arguments and forwards them to pkg-config without allowlisting the accepted flags. This design assumed pkg-config arguments were benign package identifiers, but pkg-config accepts operational flags such as --log-file that alter its filesystem behavior.

Attack Vector

Exploitation requires the victim to run go build, go install, go test, or go get against a source tree containing the malicious directive. Typical delivery paths include a poisoned third-party module pulled by go mod, a pull request to an open-source repository, or a shared workspace on a build server. The attacker needs no network access at exploit time; the vulnerability is triggered locally by the build process under the developer's or CI runner's privileges.

No verified public exploit code is available. Refer to the Go vulnerability report GO-2026-4339 and upstream change CL 736711 for the authoritative technical description and fix.

Detection Methods for CVE-2025-61731

Indicators of Compromise

Go source files containing #cgo pkg-config: directives that include flags beginning with -- such as --log-file, --define-variable, or other non-package tokens.
Unexpected file writes by the pkg-config process during go build or go test execution.
New or modified files in sensitive locations (for example ~/.ssh/, ~/.bashrc, /etc/, or CI artifact directories) with timestamps aligned to build events.

Detection Strategies

Scan repositories and vendored modules for cgo directives using regex such as #cgo[[:space:]]+pkg-config:.*-- before builds run.
Enable Go module verification with GOFLAGS=-mod=readonly and require checksum validation via go.sum to prevent silent dependency swaps.
Instrument build hosts to log process execution (execve) of pkg-config and capture its full argument vector for review.

Monitoring Recommendations

Collect CI/CD build logs centrally and alert on pkg-config invocations containing --log-file or other output-redirecting flags.
Monitor filesystem write events originating from build user accounts to paths outside expected build and cache directories.
Track installed Go toolchain versions across developer workstations and build infrastructure, alerting on hosts still running unpatched releases.

How to Mitigate CVE-2025-61731

Immediate Actions Required

Upgrade the Go toolchain to the patched release referenced in GO-2026-4339 on all developer workstations, build agents, and container base images.
Apply the relevant Red Hat errata (for example RHSA-2026:3556 and later) on RHEL-based systems that ship Go.
Audit third-party Go dependencies for suspicious #cgo pkg-config: directives, prioritizing recently added modules.

Patch Information

The upstream fix is committed in Go change list CL 736711 and announced on the golang-announce forum. The patch restricts the tokens accepted in #cgo pkg-config: directives so that flags able to influence pkg-config output are rejected. Red Hat has published a broad set of errata tracked under the Red Hat CVE-2025-61731 Advisory for affected RHEL streams and layered products.

Workarounds

Build untrusted Go code inside ephemeral, unprivileged containers or sandboxes with read-only mounts on sensitive paths.
Set CGO_ENABLED=0 when compiling code from untrusted sources to disable cgo directive processing entirely.
Pin and vet dependencies with go mod vendor and code review, rejecting modules whose cgo directives contain flag-style arguments.

bash

# Configuration example
# Disable cgo when building untrusted modules
export CGO_ENABLED=0
go build -mod=readonly ./...

# Verify installed Go version includes the CVE-2025-61731 fix
go version
go env GOVERSION

# Scan a repository for suspicious cgo pkg-config directives
grep -rEn '#cgo[[:space:]]+pkg-config:.*--' .