Walk/WalkDir in path/filepath susceptible to symlink race
At a glance
Severity
LOW 3.7
EPSS
EPSS 0.22 % · percentile 12 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
Go
NVD status
Deferred
Description
The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.
