Is CVE-2026-39822 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39822 being exploited in the wild.

How severe is CVE-2026-39822?

Informational severity, published 8 July 2026.

Which products and versions are affected?

stdlib (Go) SEMVER:introduced=0,fixed=1.25.12,introduced=1.26.0-0,fixed=1.26.5,introduced=1.27.0-0,fixed=1.27.0-rc.2.

Is there a fix for CVE-2026-39822?

Yes. stdlib (Go): upgrade to 1.27.0-rc.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39822 attacked?

It is attacked with local access or over the network, in a software library.

Am I affected by CVE-2026-39822?

Check whether you run stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39822: Go os package path traversal via symlink with trailing slash in os.Root

CVE-2026-39822 · Severity: info · Published 2026-07-08

A vulnerability in the Go programming language's standard library could allow a program to unintentionally access files outside of a restricted directory. This occurs when a program uses the 'os.Root' feature to limit file access but encounters a symbolic link with a trailing slash. An attacker could potentially use this to read or write sensitive files on the host system that should have been inaccessible to the application.

Technologies: stdlib (Go). Vendors: Go.

Quick answers

Is CVE-2026-39822 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39822 being exploited in the wild.
How severe is CVE-2026-39822?: Informational severity, published 8 July 2026.
Which products and versions are affected?: stdlib (Go) SEMVER:introduced=0,fixed=1.25.12,introduced=1.26.0-0,fixed=1.26.5,introduced=1.27.0-0,fixed=1.27.0-rc.2.
Is there a fix for CVE-2026-39822?: Yes. stdlib (Go): upgrade to 1.27.0-rc.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39822 attacked?: It is attacked with local access or over the network, in a software library.
Am I affected by CVE-2026-39822?: Check whether you run stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

stdlib (Go): upgrade to 1.27.0-rc.2 or later
```
go get stdlib@v1.27.0-rc.2
```

Technical details

A path traversal vulnerability exists in the Go 'os' package's os.Root implementation on Unix systems. The root cause is a failure to account for the behavior of the 'openat' system call when the O_NOFOLLOW flag is used with a path ending in a trailing slash (e.g., "symlink/"). In such cases, the operating system follows the symbolic link despite the O_NOFOLLOW flag. An attacker can exploit this by providing a path that references a symlink pointing outside the os.Root boundary, effectively escaping the restricted file system view. This affects several functions including Root.Open, Root.Create, and Root.ReadFile. The issue is fixed in Go versions 1.25.12, 1.26.5, and 1.27.0-rc.2.

Affected products

Go os < 1.25.12, >= 1.26.0-0 < 1.26.5, >= 1.27.0-0 < 1.27.0-rc.2

Identifiers

CVE-2026-39822
GO-2026-4970

Timeline

2026-04-29: disclosed: Issue reported to Go project
2026-07-07: advisory: Go vulnerability report GO-2026-4970 published
2026-07-08: disclosed: CVE-2026-39822 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.