CVE-2026-39822

Отчет

A flaw was found in Go's os.Root implementation. On Unix systems, os.Root.Open() improperly follows symlinks to locations outside the root directory when the path ends with a trailing slash (e.g., root.Open("symlink/")). This is because openat() with O_NOFOLLOW does not prevent symlink resolution when the path has a trailing /. An attacker able to create symlinks within an os.Root directory could use this to read or write files outside the intended root. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5. The following symbols are affected:

• OpenInRoot: Opens a file or directory within an os.Root.
• Root.Create: Creates a file inside an os.Root.
• Root.Open: Opens a path relative to an os.Root.
• Root.OpenFile: Opens a file with specified flags and permissions inside an os.Root.
• Root.OpenRoot: Opens a sub-root directory from an os.Root.
• Root.ReadFile: Reads a file inside an os.Root.
• Root.WriteFile: Writes a file inside an os.Root.

Меры по смягчению последствий

There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go >= 1.24 that do not use the os.Root API are not affected by this vulnerability. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5.