CVE-2024-8244

Walk/WalkDir in path/filepath susceptible to symlink race

Published Aug 6, 2025 CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Description
The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-54850 The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Type Values Removed Values Added
First Time appeared Golang
Golang go
Vendors & Products Golang
Golang go
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.
Title Walk/WalkDir in path/filepath susceptible to symlink race
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Go
Published
Updated
Nov 3, 2025, 7:47 PM
Reserved
Aug 27, 2024, 7:41 PM
Status
Deferred
Published
Aug 6, 2025, 4:15 PM
Modified
Jun 17, 2026, 8:22 AM
Severity
Moderate
Public date
Aug 6, 2025, 3:32 PM