CVE-2026-39822: Root escape via symlink plus trailing slash in os
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Goto a version that resolves this vulnerability.Fixed in 1.26.5Patch CVE-2026-39822 & CVE-2026-42505 - Upgrade
Upgrade
Goto a version that resolves this vulnerability.Fixed in 1.25.12Patch CVE-2026-39822 & CVE-2026-42505
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39822?
The severity of CVE-2026-39822 is high, rated at 7.8 on the CVSS scale.
How do I fix CVE-2026-39822?
To fix CVE-2026-39822, update your Go software to the latest version where the vulnerability has been addressed.
What systems are affected by CVE-2026-39822?
CVE-2026-39822 affects Unix systems that use the Golang Go programming language.
What type of vulnerability is CVE-2026-39822?
CVE-2026-39822 is a root escape vulnerability that improperly follows symlinks in file paths.
What are the potential impacts of CVE-2026-39822?
The potential impacts of CVE-2026-39822 include unauthorized access to sensitive files outside of the intended root directory.