CVE-2026-56857GO-2026-6604BIT-GOLANG-2026-56857
Root.Mkdir(All) can follow junctions out of the root on Windows in os
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 1.26.9, 1.27.2
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: yes
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
Affected versions
- os
fixed in 1.26.9; From 1.27.0-0 · fixed in 1.27.2
- internal/syscall/windows
fixed in 1.26.9; From 1.27.0-0 · fixed in 1.27.2
- stdlibGo
fixed in 1.26.9; From 1.27.0-0 · fixed in 1.27.2