Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-56857

Root.Mkdir(All) can follow junctions out of the root on Windows in os

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Go Standard Library
Products
Internal/syscall/windows Os
CVE-2026-39822

Root escape via symlink plus trailing slash in os

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Go Standard Library Golang
Products
Os Go
CVE-2026-27139

FileInfo can escape from a Root in os

On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Go Standard Library Golang
Products
Os Go
CVE-2025-22873

Improper access to parent directory of root in os

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Go Standard Library Golang
Products
Os Go