CVE-2025-61731
BaseFortify
Publication date: 2026-01-28
Last updated on: 2026-02-06
Assigner: Go Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| golang | go | to 1.24.12 (exc) |
| golang | go | From 1.25.0 (inc) to 1.25.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs when a malicious file built with cmd/go uses the "#cgo pkg-config:" directive in a Go source file to pass command-line arguments to the Go pkg-config command. An attacker can supply a "--log-file" argument through this directive, causing pkg-config to write to a file at an attacker-controlled location with partial control over the file content.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to write to files at locations they control, potentially leading to unauthorized file modification or creation. This could be exploited to overwrite important files or inject malicious content, impacting system integrity or security.