Skip to content
fr Sign in
7.8 High

CVE-2026-39822 On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the…

Description

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

Affected products and versions

Product Affected versions Fixed in
os 1.27 earliest → < 1.27.0-rc.2 1.27.0-rc.2
os 1.26 1.26.0-0 → < 1.26.5 1.26.5
os 1.25 earliest → < 1.25.12 1.25.12

References

Timeline

  1. Published
  2. Last modified

Other CVEs of os

The 6 CVEs of os →
CVE-2026-56857 On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation… 9.8 Critical CVE-2026-27139 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo… 2.5 Low CVE-2025-22873 It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../" 3.8 Low CVE-2025-0913 os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a… 5.5 Medium
Track this CVE