CVE-2026-39822

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-39822
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39822.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-39822
Aliases
Downstream
AZL (2)
BELL (1)
CGA (9078)
CLEANSTART (196)
CLSA (1)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (1782)
openSUSE (8)
RHSA (16)
RLSA (7)
SUSE (10)
UBUNTU (1)
Related
ALSA (7)
openSUSE (8)
SUSE (10)
Published
2026-07-08T15:46:27Z
Modified
2026-10-27T02:31:01Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Root escape via symlink plus trailing slash in os
Details

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

Database specific 
{
    "cna_assigner":  "Go",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39822.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "1.25.12"
                        },
                        {
                            "introduced":  "1.26.0-0"
                        },
                        {
                            "fixed":  "1.26.5"
                        },
                        {
                            "introduced":  "1.27.0-0"
                        },
                        {
                            "fixed":  "1.27.0-rc.2"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/golang/go

Affected ranges

Type
GIT
Repo
https://github.com/golang/go
Events
Introduced
3901409b5d0fb7c85a3e6730a59943cc93b2835c
Fixed
d80d9a98f7e3a8f9b3a82d2c6079f84eb1101d46
Introduced
d90b98e65320778f3b1f99a6951ab20f04d218b3
Fixed
c19862e5f8415b4f24b189d065ed739517c548ba
Introduced
eefb454307250192f45fa3718685e4c0a90e281d
Last Affected
eefb454307250192f45fa3718685e4c0a90e281d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.24.0"
                },
                {
                    "fixed":  "1.25.12"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.26.0"
                },
                {
                    "fixed":  "1.26.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:golang:go:1.27:rc1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.27-rc1"
                },
                {
                    "last_affected":  "1.27-rc1"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

1.*
1.27-rc1
go1.*
go1.26.0
go1.26.1
go1.26.2
go1.26.3
go1.26.4
go1.27rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39822.json"