This vulnerability allows the FileInfo object returned by File.ReadDir or File.Readdir on Unix systems to reference a file outside of the directory’s initial root. As a result, an application can obtain limited metadata about arbitrary files through the operating system’s lstat system call, but cannot read or write those files. The weakness stems from insufficient path validation and is classified as CWE-22, a path traversal issue.

Affected vendors include the Go standard library (product os). The flaw is present in Go releases that have not yet applied the related fix. No specific version list is provided, so all Go versions prior to the patch are considered vulnerable when running on Unix platforms.

The CVSS score of 2.5 indicates a low severity issue, and an EPSS score of less than 1% reflects a very low likelihood of exploitation in the wild. The flaw has not been listed in the CISA KEV catalog. Exploitation is possible only from within the same host and requires that an attacker can influence or observe a process performing directory reads. While no remote code execution or data exfiltration is gained, the ability to learn sensitive file metadata could aid in further attacks.