Skip to content
CVE PROGRAM SOURCE RECORD3.7 Low

CVE-2024-8244

Walk/WalkDir in path/filepath susceptible to symlink race

Description

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library path/filepath

Default version status: affected

References