Walk/WalkDir in path/filepath susceptible to symlink race
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Go standard library | path/filepath | affected | — |
No data.
No data.
| Vendor | Product | Versions |
|---|---|---|
| Golang | Go | — |
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2024-54850 | The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress. |
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.232% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Golang
Golang go |
|
| Vendors & Products |
Golang
Golang go |
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-367 | |
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress. | |
| Title | Walk/WalkDir in path/filepath susceptible to symlink race | |
| References |
|
View source · Bugzilla · JSON
OpenCVE enrichment
Updated: Aug 12, 2025, 7:49 AM
EUVD