Vulnerability when creating log files in github.com/golang/glog

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2024-45339 · CVE overview and exploitation status

EUVD-2025-0139

GHSA-6wxm-mpqj-6jpf

GO-2025-3372

cve-program · CVE-2024-45339

• https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2
• https://github.com/golang/glog/pull/74
• https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs
• https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File
• https://pkg.go.dev/vuln/GO-2025-3372

euvd · EUVD-2025-0139

• https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2
• https://github.com/golang/glog/pull/74
• https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs
• https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File
• https://pkg.go.dev/vuln/GO-2025-3372

nvd · CVE-2024-45339

• https://github.com/golang/glog/pull/74
• https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2
• https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs
• https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File
• https://pkg.go.dev/vuln/GO-2025-3372
• https://lists.debian.org/debian-lts-announce/2025/02/msg00019.html

osv · GHSA-6wxm-mpqj-6jpf

• https://nvd.nist.gov/vuln/detail/CVE-2024-45339
• https://github.com/golang/glog/pull/74
• https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2
• https://github.com/golang/glog
• https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs
• https://lists.debian.org/debian-lts-announce/2025/02/msg00019.html
• https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File
• https://pkg.go.dev/vuln/GO-2025-3372

osv · GO-2025-3372

• https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2
• https://github.com/golang/glog/pull/74
• https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs
• https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File

• When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs… · Advisory content revised · 15 Nov 2026
• Release 2025-03-16 · Tool release · 21 Mar 2025