CVE-2026-27139

Description

On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.

PUBLISHED Reserved 2026-02-17 | Published 2026-03-06 | Updated 2026-03-06 | Assigner Go

Problem types

CWE-363: Race Condition Enabling Link Following

Product status

Credits

Miloslav Trmač of Red Hat

References

groups.google.com/g/golang-announce/c/EdhZqrQ98hk

go.dev/issue/77827

go.dev/cl/749480

pkg.go.dev/vuln/GO-2026-4602

cve.org (CVE-2026-27139)

nvd.nist.gov (CVE-2026-27139)

Download JSON