Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-39822

Root escape via symlink plus trailing slash in os

Description

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library os

Default version status: unaffected

  • 0 to < 1.25.12affected
  • 1.26.0-0 to < 1.26.5affected
  • 1.27.0-0 to < 1.27.0-rc.2affected

References