CVE-2026-39822

Published: Jul 8, 2026Modified: Jul 13, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

Affected (3)

Products: Golang: Go

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Golang Go	Before 1.25.12
Golang Go	From 1.26.0 to 1.26.5
Golang Go	Version 1.27 rc1

Related CWEs

UNIX Symbolic Link (Symlink) Following

The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

References (4)

https://go.dev/cl/797880

Source: security@golang.org

Patch

https://go.dev/issue/79005

Source: security@golang.org

Issue TrackingPatch

https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc

Source: security@golang.org

Mailing ListPatchVendor Advisory

https://pkg.go.dev/vuln/GO-2026-4970

Source: security@golang.org

Vendor Advisory

Timeline

No history available yet.