CVE-2026-56857: falha crítica em Go standard library internal/syscall/windows
Root.Mkdir(All) can follow junctions out of the root on Windows in os
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.6%
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVEs relacionadas — Go standard library internal/syscall/windows
No mesmo produto, das mais perigosas para as menos.
CVE-2022-41720HIGHRestricted file access on Windows in os and net/httpEPSS 1.3%CVE-2025-0913MEDIUMInconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscallEPSS 0.3%CVE-2025-22873LOWImproper access to parent directory of root in osEPSS 0.2%CVE-2026-39822HIGHRoot escape via symlink plus trailing slash in osEPSS 0.2%CVE-2026-27139LOWFileInfo can escape from a Root in osEPSS 0.2%