Executive brief
A vulnerability in the Go programming language's standard library could allow a program to unintentionally access files outside of a restricted directory. This occurs when a program uses the 'os.Root' feature to limit file access but encounters a symbolic link with a trailing slash. An attacker could potentially use this to read or write sensitive files on the host system that should have been inaccessible to the application.
Technical details
A path traversal vulnerability exists in the Go 'os' package's os.Root implementation on Unix systems. The root cause is a failure to account for the behavior of the 'openat' system call when the O_NOFOLLOW flag is used with a path ending in a trailing slash (e.g., "symlink/"). In such cases, the operating system follows the symbolic link despite the O_NOFOLLOW flag. An attacker can exploit this by providing a path that references a symlink pointing outside the os.Root boundary, effectively escaping the restricted file system view. This affects several functions including Root.Open, Root.Create, and Root.ReadFile. The issue is fixed in Go versions 1.25.12, 1.26.5, and 1.27.0-rc.2.
Affected products
- Go os < 1.25.12, >= 1.26.0-0 < 1.26.5, >= 1.27.0-0 < 1.27.0-rc.2
Timeline
- 2026-04-29: disclosed: Issue reported to Go project
- 2026-07-07: advisory: Go vulnerability report GO-2026-4970 published
- 2026-07-08: disclosed: CVE-2026-39822 published