CVE-2026-27139: fallo de gravedad baja en Go standard library os
FileInfo can escape from a Root in os
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 2.5epss 0.2%
On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Productos afectados
Go standard library · osCVEs relacionadas — Go standard library os
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-41720HIGHRestricted file access on Windows in os and net/httpEPSS 1.3%CVE-2026-56857CRITICALRoot.Mkdir(All) can follow junctions out of the root on Windows in osEPSS 0.6%CVE-2025-0913MEDIUMInconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscallEPSS 0.3%CVE-2025-22873LOWImproper access to parent directory of root in osEPSS 0.2%CVE-2026-39822HIGHRoot escape via symlink plus trailing slash in osEPSS 0.2%