CVE-2026-39822: falha de alta gravidade em Go standard library os
Root escape via symlink plus trailing slash in os
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.8epss 0.2%
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Go standard library · osCVEs relacionadas — Go standard library os
No mesmo produto, das mais perigosas para as menos.
CVE-2022-41720HIGHRestricted file access on Windows in os and net/httpEPSS 1.3%CVE-2026-56857CRITICALRoot.Mkdir(All) can follow junctions out of the root on Windows in osEPSS 0.6%CVE-2025-0913MEDIUMInconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscallEPSS 0.3%CVE-2025-22873LOWImproper access to parent directory of root in osEPSS 0.2%CVE-2026-27139LOWFileInfo can escape from a Root in osEPSS 0.2%