CVE-2026-39822

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

• golang-1.27 1.27~rc2-1
• golang-1.26 1.26.5-1
• golang-1.25 1.25.12-1
• golang-1.24 [trixie] - golang-1.24 (Minor issue)
• golang-1.19 [bookworm] - golang-1.19 (os.Root API introduced in Go 1.24; absent in 1.19)
• golang-1.15 (Vulnerable code introduced later) os.Root API introduced in Go 1.24 (go.dev/doc/go1.24) https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc https://github.com/golang/go/issues/79005 Fixed by: https://github.com/golang/go/commit/f9ef7f55988f03afeb3b8354367d0fa8d053683d (go1.26.5) Fixed by: https://github.com/golang/go/commit/c94048f5638bbcaa22102bade5e9774e0d485315 (go1.25.12)