Root escape via symlink plus trailing slash in os

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-39822 · Microsoft / collected KEV context

GO-2026-4970

BIT-golang-2026-39822

cve-program · CVE-2026-39822

• https://go.dev/issue/79005
• https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc
• https://go.dev/cl/797880
• https://pkg.go.dev/vuln/GO-2026-4970

nvd · CVE-2026-39822

• https://go.dev/cl/797880
• https://go.dev/issue/79005
• https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc
• https://pkg.go.dev/vuln/GO-2026-4970

osv · GO-2026-4970

• https://go.dev/issue/79005
• https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc
• https://go.dev/cl/797880

No related operational record is retained in the current change model.