GO-2026-4970

See a problem?
Please try reporting it to the source first.
Source
https://pkg.go.dev/vuln/GO-2026-4970
Import Source
https://vuln.go.dev/ID/GO-2026-4970.json
JSON Data
https://api.osv.dev/v1/vulns/GO-2026-4970
Aliases
  • CVE-2026-39822
Related
Published
2026-07-07T21:34:47Z
Modified
2026-07-08T20:29:26.853236160Z
Summary
Root escape via symlink plus trailing slash in os
Details

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.

For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

Database specific 
{
    "url": "https://pkg.go.dev/vuln/GO-2026-4970",
    "review_status": "REVIEWED"
}
References
Credits
    • Mundur (https://github.com/M0nd0R)

Affected packages

Go / stdlib

Package

Name
stdlib
View open source insights on deps.dev
Purl
pkg:golang/stdlib

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.25.12
Introduced
1.26.0-0
Fixed
1.26.5
Introduced
1.27.0-0
Fixed
1.27.0-rc.2

Ecosystem specific 

{
    "imports": [
        {
            "path": "os",
            "symbols": [
                "OpenInRoot",
                "Root.Create",
                "Root.Open",
                "Root.OpenFile",
                "Root.OpenRoot",
                "Root.ReadFile",
                "Root.WriteFile",
                "openRootInRoot",
                "rootFS.Open",
                "rootFS.ReadDir",
                "rootFS.ReadFile",
                "rootOpenFileNolog"
            ]
        }
    ]
}

Database specific

source 
"https://vuln.go.dev/ID/GO-2026-4970.json"