CVE-2026-27139: falha de baixa gravidade em Go standard library os
FileInfo can escape from a Root in os
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2.5epss 0.2%
On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Go standard library · osCVEs relacionadas — Go standard library os
No mesmo produto, das mais perigosas para as menos.
CVE-2022-41720HIGHRestricted file access on Windows in os and net/httpEPSS 1.3%CVE-2026-56857CRITICALRoot.Mkdir(All) can follow junctions out of the root on Windows in osEPSS 0.6%CVE-2025-0913MEDIUMInconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscallEPSS 0.3%CVE-2025-22873LOWImproper access to parent directory of root in osEPSS 0.2%CVE-2026-39822HIGHRoot escape via symlink plus trailing slash in osEPSS 0.2%