CVE-2026-39822

Description

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

PUBLISHED Reserved 2026-04-07 | Published 2026-07-08 | Updated 2026-07-08 | Assigner Go

Problem types

CWE-61: UNIX Symbolic Link (Symlink) Following

Product status

Credits

Mundur (https://github.com/M0nd0R)

References

go.dev/issue/79005

groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc

go.dev/cl/797880

pkg.go.dev/vuln/GO-2026-4970

cve.org (CVE-2026-39822)

nvd.nist.gov (CVE-2026-39822)

Download JSON