Skip to main content

Go standard library CVE-2026-39822

| EUVDEUVD-2026-42316 HIGH
UNIX Symbolic Link (Symlink) Following (CWE-61)
2026-07-08 Go GHSA-xcgv-8mv7-v8c7
Information Disclosure Os Go Standard Library
7.8
CVSS 3.1 · Vendor: Go
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain write access inside os.Root directory
  2. Delivery
    Plant symlink pointing outside root
  3. Exploit
    Request symlink path with trailing slash
  4. Execution
    os.Root follows symlink past boundary
  5. Impact
    Read or overwrite files outside sandbox

Vulnerability Assessment

Weakness
CWE
CWE-61
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling UNIX symlink resolution
Exploitation Conditions

Exploitation requires all of: a Unix (non-Windows) target; an application that uses the os.Root API as a security boundary; and an attacker able to (a) cause a symbolic link to exist as the final path component within the root and (b) supply an os.Root path whose final component is that symlink and which ends in a trailing slash ('/'). The trailing slash on a final-symlink component is the exact triggering condition. Limiting factors: the flaw is inert for any program that does not use os.Root, does not apply on Windows, requires attacker control or influence over both symlink creation and the requested path string, and only exposes filesystem locations the process can already reach at the OS level - os.Root is a logical sandbox, not a privilege boundary.
Impact

The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-privilege attacker achieving high confidentiality, integrity, and availability impact. This is a defense-in-depth control bypass rather than a directly remote memory-safety bug: it only matters where an application actually uses os.Root to sandbox untrusted paths or symlinks, so real-world risk is highly conditional on usage. No EPSS score was provided, it is not in CISA KEV, and no POC is referenced, so there is no evidence of active or automated exploitation - consistent with a subtle library-level flaw rather than a mass-exploited one. Key caveat: the AV:L base metric can understate risk, because if a network-facing service uses os.Root to serve or write files based on attacker-influenced paths, the escape becomes remotely reachable even though the base vector says local - evaluate against the specific application, not the CVSS score alone.
Exploit ScenarioDerived

A Go service uses os.Root to sandbox a directory and reads or writes files based on untrusted input paths. An attacker who can create a symbolic link inside that directory (or influence a path resolving to one) requests it with a trailing slash, causing os.Root to follow the link to a sensitive location outside the root and read or overwrite files there. No public exploit code is identified at time of analysis, but the local, low-complexity vector makes exploitation straightforward once the attacker controls a symlink and the trailing-slash path.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 08, 2026

Sandbox escape in the Go standard library's os.Root API (os package) on Unix systems allows filesystem operations meant to be confined to a directory to reach files outside it. When a path's final component is a symbolic link and the path ends in a trailing slash (e.g. root.Open("symlink/")), os.Root improperly dereferences that symlink to a location outside the root, defeating the traversal protection the API is designed to enforce. Affects Go before 1.25.12, 1.26.5, and 1.27.0-rc.2; no public exploit is identified at time of analysis and it is not in CISA KEV.

RemediationAI

Vendor-released patch: upgrade the Go toolchain to 1.25.12, 1.26.5, or 1.27.0-rc.2 (or later) and rebuild affected applications, since the fix ships in the standard library (fix commit https://go.dev/cl/797880, tracking issue https://go.dev/issue/79005, advisory https://pkg.go.dev/vuln/GO-2026-4970). Because the flaw is compiled into the binary, you must redeploy rebuilt binaries - patching only the host Go install does not fix already-built services. If immediate recompilation is not possible, a targeted workaround is to normalize and reject caller-supplied paths ending in a trailing slash before passing them to os.Root operations, and add an explicit lstat/symlink check on the final component rather than relying on os.Root as the sole sandbox; the trade-off is added path-handling code and possible breakage of legitimate directory-style ('dir/') paths. Additional advisories: oss-security https://seclists.org/oss-sec/2026/q3/102 and https://vuldb.com/vuln/376920.

Affected VersionsENISA

os 1.26.0-0 <1.26.5
os 1.27.0-0 <1.27.0-rc.2
os 0 <1.25.12

Affected Packages

go stdlib fix: 1.25.12, 1.26.5, 1.27.0-rc.2
euvd os fix: 1.25.12, 1.26.5, 1.27.0-rc.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

os.Root is a Go standard-library sandboxing primitive in the os package that confines filesystem operations to a directory subtree and is specifically intended to resist path-traversal and symlink attacks by validating each path component so symlinks cannot escape the root. This is a CWE-61 (UNIX symbolic link following) failure in that component-resolution logic: on Unix, when the final path component is a symlink and the caller supplies a trailing slash, the trailing slash causes the resolver to follow the final symlink outside the root instead of treating it as confined. Per the supplied CPE (cpe:2.3:a:go_standard_library:os), the vulnerable component is the os package itself, so any application built with an affected Go toolchain that relies on os.Root as a security boundary inherits the weakness.

Know when Os gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Go) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Local escape requiring the attacker to place a symlink inside the root (PR:L, AV:L, AC:L); following it outside enables reading and overwriting arbitrary reachable files, so C/I/A:H with unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.7 HIGH
AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Red Hat 7.8 HIGH

Primary rating from Vendor (Go).

CVSS VectorVendor: Go

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
Jul 08, 2026 - 20:22 NVD
7.8 (HIGH)
Patch available
Jul 08, 2026 - 18:02 EUVD
CVE Published
Jul 08, 2026 - 15:46 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

Executive ViewAI

Why It Matters

Go applications using filesystem sandbox controls are vulnerable to escape attacks through symbolic link manipulation (CVE-2026-39822), potentially exposing isolated data and undermining containerization security boundaries. This affects any organization relying on Go's os.Root API for privilege separation or tenant isolation in production systems. Upgrading to the latest patched Go versions is critical to maintain filesystem access controls.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 92% exploitable
Prevalence
High
Go standard library is ubiquitous, but the newer os.Root sandbox API is less widely used
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Os

View all
CVE-2026-56857 CRITICAL
9.8 Oct 08

Go's os.Root API on Windows can be tricked into creating a directory outside the sandboxed root when the final path comp

Same weakness CWE-61 – UNIX Symbolic Link (Symlink) Following

View all
CVE-2026-54420 HIGH POC
8.5
CVE-2026-27976 HIGH POC
8.8
CVE-2024-22014 HIGH POC
8.8
CVE-2025-52565 HIGH POC
8.4
CVE-2026-39860 HIGH POC
8.4
CVE-2026-54574 HIGH POC
8.2
CVE-2026-41326 HIGH POC
8.2
CVE-2025-1079 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:36477 ADVISORY https://access.redhat.com/errata/RHSA-2026:36510 ADVISORY https://access.redhat.com/errata/RHSA-2026:37435 ADVISORY https://access.redhat.com/errata/RHSA-2026:37436 ADVISORY https://access.redhat.com/errata/RHSA-2026:38493 ADVISORY https://access.redhat.com/errata/RHSA-2026:38494 ADVISORY https://access.redhat.com/errata/RHSA-2026:38878 ADVISORY https://access.redhat.com/errata/RHSA-2026:38995 ADVISORY https://access.redhat.com/errata/RHSA-2026:44624 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-39822 ADVISORY https://seclists.org/oss-sec/2026/q3/102 ADVISORY https://vuldb.com/vuln/376920 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22638/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22641/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22643/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22656/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2817/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2818/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3046/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3047/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3102/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3151/ REF https://go.dev/cl/797880 REF https://go.dev/issue/79005 REF https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc REF https://pkg.go.dev/vuln/GO-2026-4970

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy