9.8
Critique
CVE-2026-56857 On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation…
Description
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| os 1.27 | 1.27.0-0 → < 1.27.2 | 1.27.2 |
| os 1.26 | premières → < 1.26.9 | 1.26.9 |
| internal/syscall/windows 1.27 | 1.27.0-0 → < 1.27.2 | 1.27.2 |
| internal/syscall/windows 1.26 | premières → < 1.26.9 | 1.26.9 |
Références
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Chronologie
- Publiée
- Dernière modification
Autres CVE de os
Les 6 CVE de os →
CVE-2026-39822
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the…
7.8
Élevée
CVE-2026-27139
On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo…
2.5
Faible
CVE-2025-22873
It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../"
3.8
Faible
CVE-2025-0913
os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a…
5.5
Moyenne