EUVD-2026-95420
GHSA-c3q7-m35p-9qq7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted path/archive to os.Root-based app
-
ExploitJunction (to empty target) placed as final path component
-
ExecutionRoot.Mkdir/MkdirAll follows junction
-
ImpactDirectory created outside root sandbox
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation is limited to Windows and requires an application that uses Go's os.Root API (introduced in Go 1.24) with a vulnerable toolchain (os/internal/syscall/windows before 1.26.9 or before 1.27.2). The target of Root.Mkdir or Root.MkdirAll must be a junction that points to an empty location, AND that junction must be the LAST component of the path (path/to/junction works; path/junction/target does not). The attacker must be able to influence the filesystem or path input so that such a junction exists. Key LIMITING factors: non-Windows platforms are unaffected; applications not using os.Root are unaffected; the primitive is confined to creating a directory outside the root (no arbitrary file read, content write, or code execution is described), which substantially bounds impact despite the 9.8 score. |
| Impact | The signals here conflict sharply and the headline CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates real-world risk. This is a sandbox-escape bug in the Go standard library's os.Root API on Windows, not a remotely triggerable code-execution flaw: the C:H/I:H/A:H 'total impact' rating is not supported by the description, where the actual primitive is limited to creating a directory at a junction target outside the intended root. Lower-level signals point to modest priority: EPSS is 0.21% (10th percentile), there is no CISA KEV listing, and SSVC records Exploitation=none. SSVC does flag Automatable=yes and Technical Impact=total, which is why automated scanners may escalate it, but exploitation requires Windows, an application built on Go's os.Root (Go 1.24+), and a junction pointing to an empty location as the final path component - conditions that do not match an AC:L/PR:N network-exploitable profile. Net: a legitimate security-boundary bypass worth patching in affected Go toolchains, but closer to a medium/low real-world risk than a critical actively-exploited threat. Verify the inflated CVSS impact against the Go advisory (GO-2026-6604) rather than treating 9.8 as confirmed. |
| Exploit ScenarioDerived | A Windows service uses Go's os.Root to safely extract or write into an untrusted archive or user-supplied path tree. The input contains (or the attacker has pre-placed) a junction as the final path component pointing to an empty location outside the root; when the service calls Root.Mkdir or Root.MkdirAll on that component, a directory is created outside the intended sandbox. No public exploit code is identified at time of analysis, and the CVSS AC:L rating understates the junction and Windows preconditions actually required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Go's os.Root API on Windows can be tricked into creating a directory outside the sandboxed root when the final path component passed to Root.Mkdir or Root.MkdirAll is a junction that resolves to an empty location, allowing an attacker who can influence filesystem layout or path input to escape the intended root boundary. Only Windows applications built with a vulnerable Go toolchain (os and internal/syscall/windows before 1.26.9, or the 1.27.0 pre-release line before 1.27.2) that actually use os.Root are affected; non-Windows builds and applications not using os.Root are not impacted. The headline CVSS 9.8 overstates real-world risk: our independent assessment scores it AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N because the primitive is confined to directory creation outside the root, with no arbitrary file read, content write, or code execution described. EPSS is 0.21% (10th percentile), no public exploit has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
RemediationAI
Vendor-released patch: upgrade the Go toolchain to 1.26.9 or 1.27.2 (or later) depending on the release line in use, then rebuild and redeploy any Windows binaries that use os.Root; the fix is delivered through the standard Go toolchain so no separate library patch is required. Go module users can pin the toolchain in go.mod to force a patched build, and CI pipelines should be checked so cached or pinned older toolchains do not silently reintroduce the issue. If immediate rebuild is not possible, mitigate by not passing junction-terminated paths to Root.Mkdir or Root.MkdirAll - resolve or reject the final path component before the call and refuse to operate when it is a reparse point - recognizing that this is an application-level check that must be maintained across every call site. Additionally, restrict write access to directories that attackers could use to plant junctions inside or adjacent to the root, since exploitation requires the attacker to influence filesystem layout; the trade-off is tighter directory ACLs that may interfere with legitimate multi-service deployments on the same host. Blocking untrusted path input from reaching os.Root APIs is a further compensating control, with the caveat that it does not protect against locally planted junctions where the attacker already has filesystem write access. Applications that do not use os.Root, and all non-Windows deployments, require no action.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Go 1.24 introduced os.Root as a chroot-like abstraction that confines filesystem operations to a designated directory subtree, implemented on Windows through the os/internal/syscall/windows package (tracked in CPE as internal/syscall/windows). The root cause is CWE-1386 (Insecure Operation on Windows Junction / Mount Point): the Windows path-resolution logic does not correctly re-validate reparse points when the last component of the requested path is itself a junction, so a junction pointing to an empty directory is followed rather than rejected. Because Mkdir and MkdirAll only need to materialize a new directory, the traversal is limited to that primitive - the operation creates the directory at the junction target outside the root but does not grant arbitrary content write, read, or execution. The restriction that the junction must be the final path component (path/to/junction works, path/junction/target does not) narrows the exploitable surface considerably and is the reason our assessed vector downgrades attack complexity to High and impact to Integrity:Low only. Upstream tracking is via Go issue 81739 and change 847305, with the vulnerability catalogued as GO-2026-6604 and EUVD-2026-95420. The official NVD score of 9.8 reflects a generic worst-case reading of the description rather than the constrained, directory-creation-only primitive actually described.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires Windows plus a junction (to an empty target) as the final path component and an os.Root-based app, so AC:H; impact is limited to creating a directory outside the root, so I:L with C:N/A:N.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Go
Lifecycle Timeline
3DescriptionCVE.org
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
Articles & Coverage 1
Executive ViewAI
Windows applications built with vulnerable Go toolchains that use the os.Root API can be tricked into creating directories outside the intended sandbox root. Although the headline CVSS is critical, the independently assessed impact is limited to integrity, with no described file read, content write, or code execution, and no public exploit identified at time of analysis. Leadership should care because remediation requires identifying affected Go-built Windows services and rebuilding them with a patched toolchain, making this a supply-chain and build-pipeline issue rather than a simple runtime configuration fix.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB