CVE-2024-8244

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.

Score

CVSS 3.1 3.7 Low

Status

Deferred - security@golang.org

Published

2025-08-06

Last modified

2025-11-03

Affected products

• Pathfilepath (Go Standard Library)

References

• https://go.dev/issue/70007
• https://pkg.go.dev/vuln/GO-2025-9999