Aller au contenu
en Se connecter
7.8 Élevée

CVE-2026-39822 On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the…

Description

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

Produits et versions touchés

Produit Versions touchées Corrigé en
os 1.27 premières → < 1.27.0-rc.2 1.27.0-rc.2
os 1.26 1.26.0-0 → < 1.26.5 1.26.5
os 1.25 premières → < 1.25.12 1.25.12

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de os

Les 6 CVE de os →
CVE-2026-56857 On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation… 9.8 Critique CVE-2026-27139 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo… 2.5 Faible CVE-2025-22873 It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../" 3.8 Faible CVE-2025-0913 os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a… 5.5 Moyenne
Suivre cette CVE