{"id":"BIT-golang-2026-39822","revision":null,"records":[{"revision":"5bbde10616174bc1ba19d1d0c1abae8e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-39822","aliases":[],"title":"Root escape via symlink plus trailing slash in os","description":"On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.","state":0,"publishedAt":"2026-07-08T15:46:27.199+00:00","modifiedAt":"2026-07-08T19:39:17.341+00:00","affected":[{"ecosystem":"https://pkg.go.dev","name":"os","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Go standard library\",\n                    \"product\": \"os\",\n                    \"collectionURL\": \"https://pkg.go.dev\",\n                    \"packageName\": \"os\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"1.25.12\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"1.26.0-0\",\n                            \"lessThan\": \"1.26.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"1.27.0-0\",\n                            \"lessThan\": \"1.27.0-rc.2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"rootOpenFileNolog\"\n                        },\n                        {\n                            \"name\": \"openRootInRoot\"\n                        },\n                        {\n                            \"name\": \"OpenInRoot\"\n                        },\n                        {\n                            \"name\": \"Root.Create\"\n                        },\n                        {\n                            \"name\": \"Root.Open\"\n                        },\n                        {\n                            \"name\": \"Root.OpenFile\"\n                        },\n                        {\n                            \"name\": \"Root.OpenRoot\"\n                        },\n                        {\n                            \"name\": \"Root.ReadFile\"\n                        },\n                        {\n                            \"name\": \"Root.WriteFile\"\n                        },\n                        {\n                            \"name\": \"rootFS.Open\"\n                        },\n                        {\n                            \"name\": \"rootFS.ReadDir\"\n                        },\n                        {\n                            \"name\": \"rootFS.ReadFile\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://go.dev/issue/79005","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://go.dev/cl/797880","https://pkg.go.dev/vuln/GO-2026-4970"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-39822","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-39822","identifiers":["CVE-2026-39822"]},"retained":false,"historicalAffected":[]},{"revision":"ccb18d6d62a24854a9fb06b67019d321","observedAt":"2026-10-27T10:09:38.352+00:00","statement":{"source":"nvd","id":"CVE-2026-39822","aliases":[],"title":"On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open…","description":"On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.","state":0,"publishedAt":"2026-07-08T17:17:21.31+00:00","modifiedAt":"2026-10-25T17:10:00.197+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://go.dev/cl/797880","https://go.dev/issue/79005","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://pkg.go.dev/vuln/GO-2026-4970"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39822","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-61"],"productCriteria":["cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","cpe:2.3:a:golang:go:1.27:rc1:*:*:*:*:*:*"],"sourceDates":{"published":"2026-07-08T17:17:21.310","lastModified":"2026-10-25T17:10:00.197"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-39822","identifiers":["CVE-2026-39822"]},"retained":false,"historicalAffected":[]},{"revision":"17d70b5640bb4b5993af4190a67d2c61","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-4970","aliases":["BIT-golang-2026-39822","CVE-2026-39822"],"title":"Root escape via symlink plus trailing slash in os","description":"On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.\n\nFor example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.","state":0,"publishedAt":"2026-07-07T21:34:47+00:00","modifiedAt":"2026-09-16T10:41:36.5780149+00:00","affected":[{"ecosystem":"Go","name":"stdlib","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.25.12"},{"kind":"introduced","version":"1.26.0-0"},{"kind":"fixed","version":"1.26.5"},{"kind":"introduced","version":"1.27.0-0"},{"kind":"fixed","version":"1.27.0-rc.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://go.dev/issue/79005","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://go.dev/cl/797880"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-4970","license":"OSV · upstream source license applies","key":"osv:GO-2026-4970","identifiers":["GO-2026-4970","BIT-golang-2026-39822","CVE-2026-39822"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T15:15:10.0599163+00:00","complete":true,"records":1758,"lastAttemptAt":"2026-10-27T15:15:10.0599163+00:00","lastSuccessAt":"2026-10-27T15:15:10.2728795+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:15:10.2728805+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-67d02c0690a311a3477ecb30285e6a67bc5cbcf4b551d4b6cab698393621fd1a","complete":true,"records":415206,"lastAttemptAt":"2026-10-27T15:44:18.8922484+00:00","lastSuccessAt":"2026-10-27T15:44:18.7720642+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:44:18.8922484+00:00","snapshotPublishedAt":"2026-10-27T15:30:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-27T15:15:49.7535245+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":0,"expectedIdentifiers":13486},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T15:15:10.0599163+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T15:15:10.0599163+00:00","lastSuccessAt":"2026-10-27T15:15:10.2765312+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:15:10.2765323+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-88a38441ad1248599975b90993827b01","complete":false,"records":13423,"lastAttemptAt":"2026-10-27T15:15:45.1432116+00:00","lastSuccessAt":"2026-10-27T15:15:45.139+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:15:45.139+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13480,"expectedIdentifiers":13486},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-9aac152375d0a5e113d83b548d5b8eef3e502e5699b45f50871eab64fdebfbb1","complete":true,"records":9782,"lastAttemptAt":"2026-10-27T15:15:09.8979368+00:00","lastSuccessAt":"2026-10-27T15:15:09.6352152+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:15:09.8979368+00:00","snapshotPublishedAt":"2026-10-27T15:03:35+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T15:44:19.0567932+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:44:19.0567932+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-112103ad2640f03b274c0e731c3f4398f99b844297f2e68d520aeec5561d6df2","complete":true,"records":2997,"lastAttemptAt":"2026-10-27T15:15:10.0075658+00:00","lastSuccessAt":"2026-10-27T11:11:56.4872351+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:15:10.0075658+00:00","snapshotPublishedAt":"2026-10-27T10:33:05+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-7e26fba71e5cf7d18798513b59ea2bb3b5abe64df0a968b5e2c3f16d11533f05","complete":true,"records":230819,"lastAttemptAt":"2026-10-27T15:44:25.4929597+00:00","lastSuccessAt":"2026-10-27T15:14:39.610946+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:14:41.8729153+00:00","snapshotPublishedAt":"2026-10-27T15:03:39+00:00","importing":true,"stagedRecords":20500,"checkedIdentifiers":null,"expectedIdentifiers":null}]}