NotCVE-2025-0004 – Symlink Race in Go os.RemoveAll Allows Privileged File Deletion

https://notcve.org/view.php?id=NotCVE-2025-0004

30 Jun 2025 — The Go standard library function os.RemoveAll prior to Go 1.21.11 and 1.22.4 performs recursive directory deletion in a manner susceptible to a time-of-check/time-of-use (TOCTOU) race. An attacker able to swap the target directory with a symbolic link during deletion may redirect the traversal to unintended filesystem locations, allowing deletion of arbitrary files or directories. This behavior impacts any Go programs that perform recursive deletes on user-controlled paths without additional safeguards. Al... • https://github.com/kubernetes/kubernetes/issues/132267 • CWE-363: Race Condition Enabling Link Following •