CVE-2026-39822

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.

A flaw was found in Go's os.Root implementation. On Unix systems, os.Root.Open() improperly follows symlinks to locations outside the root directory when the path ends with a trailing slash (e.g., root.Open("symlink/")). This is because openat() with O_NOFOLLOW does not prevent symlink resolution when the path has a trailing /. An attacker able to create symlinks within an os.Root directory could use this to read or write files outside the intended root. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5.

The following symbols are affected:

• OpenInRoot: Opens a file or directory within an os.Root.
• Root.Create: Creates a file inside an os.Root.
• Root.Open: Opens a path relative to an os.Root.
• Root.OpenFile: Opens a file with specified flags and permissions inside an os.Root.
• Root.OpenRoot: Opens a sub-root directory from an os.Root.
• Root.ReadFile: Reads a file inside an os.Root.
• Root.WriteFile: Writes a file inside an os.Root.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go >= 1.24 that do not use the os.Root API are not affected by this vulnerability. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5.