Vulnerabilidades do Go standard library Os

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Go standard library Os: 4 registro(s), com versões afetadas e correções.

CVE-2026-56857 Crítica · 9.8 CWE-1386 08/10/2026

Root.Mkdir(All) can follow junctions out of the root on Windows in os

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

CVE-2026-39822 Alta · 7.8 CWE-61 08/07/2026

Root escape via symlink plus trailing slash in os

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

CVE-2026-27139 Baixa · 2.5 CWE-22 06/03/2026

FileInfo can escape from a Root in os

On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.

CVE-2025-22873 Baixa · 3.8 CWE-23 04/02/2026

Improper access to parent directory of root in os

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.