Skip to main content

Windows EUVDEUVD-2025-18139

| CVE-2025-0913 MEDIUM
Improper Link Resolution Before File Access (CWE-59)
2025-06-11 security@golang.org
Windows Information Disclosure Golang Microsoft Debian Ubuntu Go Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Ubuntu
MEDIUM
qualitative
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

4
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 14, 2026 - 21:09 euvd
EUVD-2025-18139
Analysis Generated
Mar 14, 2026 - 21:09 vuln.today
CVE Published
Jun 11, 2025 - 18:15 nvd
MEDIUM 5.5

DescriptionCVE.org

os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.

Analysis

os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.

Technical ContextAI

This vulnerability is classified as Improper Link Resolution Before File Access (CWE-59).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

More in Windows

View all
CVE-2019-0803 HIGH POC
7.8 Apr 09

Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in

CVE-2020-1472 MEDIUM POC
5.5 Aug 17

A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
CVE-2025-33053 HIGH POC
8.8 Jun 10

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
CVE-2025-33073 HIGH POC
8.8 Jun 10

Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
CVE-2025-13315 CRITICAL POC
9.3 Nov 19

Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
CVE-2013-10047 CRITICAL POC
9.3 Aug 01

An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote

CVE-2012-10030 CRITICAL POC
9.3 Aug 05

FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
CVE-2025-34101 CRITICAL POC
9.3 Jul 10

Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
CVE-2025-13316 HIGH POC
8.2 Nov 19

Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
CVE-2025-34095 CRITICAL POC
9.3 Jul 10

Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
CVE-2025-11953 CRITICAL POC
9.8 Nov 03

React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
CVE-2025-24054 MEDIUM POC
6.5 Mar 11

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network

Same weakness CWE-59 – Improper Link Resolution Before File Access

View all
CVE-2020-0787 HIGH POC
7.8
CVE-2015-1130 HIGH POC
7.8
CVE-2015-5287 HIGH POC
7.8
CVE-2026-41091 HIGH POC
7.8
CVE-2019-1069 HIGH POC
7.8
CVE-2026-81963 HIGH POC
7.8
CVE-2016-6664 HIGH POC
7.0
CVE-2025-60710 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

Ubuntu

Priority: Medium
golang
Release Status Version
jammy DNE -
noble DNE -
oracular DNE -
plucky DNE -
upstream needs-triage -
questing DNE -
golang-1.6
Release Status Version
xenial ignored Windows Only
jammy DNE -
noble DNE -
oracular DNE -
plucky DNE -
upstream needs-triage -
questing DNE -
golang-1.8
Release Status Version
bionic ignored Windows Only
jammy DNE -
noble DNE -
oracular DNE -
plucky DNE -
upstream needs-triage -
questing DNE -
golang-1.9
Release Status Version
bionic ignored Windows Only
jammy DNE -
noble DNE -
oracular DNE -
plucky DNE -
upstream needs-triage -
questing DNE -
golang-1.10
Release Status Version
trusty ignored Windows Only
xenial ignored Windows Only
bionic ignored Windows Only
jammy DNE -
noble DNE -
oracular DNE -
plucky DNE -
upstream needs-triage -
questing DNE -
golang-1.13
Release Status Version
xenial ignored Windows Only
bionic ignored Windows Only
focal ignored Windows Only
jammy ignored Windows Only
noble DNE -
oracular DNE -
plucky DNE -
upstream needs-triage -
questing DNE -
golang-1.14
Release Status Version
focal ignored Windows Only
jammy DNE -
noble DNE -
oracular DNE -
plucky DNE -
upstream needs-triage -
questing DNE -
golang-1.16
Release Status Version
bionic ignored Windows Only
focal ignored Windows Only
jammy DNE -
noble DNE -
oracular DNE -
plucky DNE -
upstream needs-triage -
questing DNE -
golang-1.17
Release Status Version
jammy ignored Windows Only
noble DNE -
oracular DNE -
plucky DNE -
upstream needs-triage -
questing DNE -
golang-1.18
Release Status Version
xenial ignored Windows Only
bionic ignored Windows Only
jammy ignored Windows Only
noble DNE -
oracular DNE -
plucky DNE -
upstream needs-triage -
focal needs-triage -
questing DNE -
golang-1.20
Release Status Version
jammy ignored Windows Only
noble DNE -
oracular DNE -
plucky DNE -
upstream needs-triage -
focal needs-triage -
questing DNE -
golang-1.21
Release Status Version
jammy ignored Windows Only
noble ignored Windows Only
oracular DNE -
plucky DNE -
upstream needs-triage -
focal needs-triage -
questing DNE -
golang-1.22
Release Status Version
jammy ignored Windows Only
noble ignored Windows Only
plucky DNE -
upstream needs-triage -
oracular ignored end of life, was ignored [Windows Only]
focal needs-triage -
questing DNE -
golang-1.23
Release Status Version
jammy ignored Windows Only
noble ignored Windows Only
upstream needs-triage -
oracular ignored end of life, was ignored [Windows Only]
questing ignored Windows Only
plucky ignored end of life, was ignored [Windows Only]
golang-1.24
Release Status Version
oracular DNE -
upstream needs-triage -
jammy needs-triage -
noble needs-triage -
questing ignored Windows Only
plucky ignored end of life, was ignored [Windows Only]

Debian

golang-1.15
Release Status Fixed Version Urgency
bullseye fixed 1.15.15-1~deb11u4 -
(unstable) not-affected - -
golang-1.19
Release Status Fixed Version Urgency
bookworm fixed 1.19.8-2 -
(unstable) not-affected - -
golang-1.24
Release Status Fixed Version Urgency
trixie fixed 1.24.4-1 -
forky, sid fixed 1.24.13-2 -
(unstable) not-affected - -
golang-1.23
Release Status Fixed Version Urgency
(unstable) not-affected - -

SUSE

Severity: Medium
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-4.31 Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-4.26 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-4.27 Container suse/sl-micro/6.0/rt-os-container:2.1.3-5.25 Affected
Container suse/sl-micro/6.0/toolbox:13.2-9.1 Affected
SUSE Enterprise Storage 7.1 Fixed

Share

EUVD-2025-18139 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy