{"id":"CVE-2026-39822","title":"On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /","summary":"On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will o…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-61","CWE-59"],"vendor":"golang","product":"go","affected":["go >= 1.24.0, < 1.25.12","go >= 1.26.0, < 1.26.5","go = 1.27"],"patched":["go 1.26.5"],"published":"2026-07-08","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:10:20.047","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39822","references":[{"url":"https://go.dev/cl/797880","label":"security@golang.org"},{"url":"https://go.dev/issue/79005","label":"security@golang.org"},{"url":"https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","label":"security@golang.org"},{"url":"https://pkg.go.dev/vuln/GO-2026-4970","label":"security@golang.org"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39822.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-39822"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498152"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39822"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39822"},{"url":"https://access.redhat.com/errata/RHSA-2026:66350"},{"url":"https://access.redhat.com/errata/RHSA-2026:66375"},{"url":"https://access.redhat.com/errata/RHSA-2026:57361"},{"url":"https://access.redhat.com/errata/RHSA-2026:49702"},{"url":"https://access.redhat.com/errata/RHSA-2026:38494"},{"url":"https://access.redhat.com/errata/RHSA-2026:37436"},{"url":"https://access.redhat.com/errata/RHSA-2026:38995"},{"url":"https://access.redhat.com/errata/RHSA-2026:61253"},{"url":"https://access.redhat.com/errata/RHSA-2026:57649"},{"url":"https://access.redhat.com/errata/RHSA-2026:49712"},{"url":"https://access.redhat.com/errata/RHSA-2026:38493"},{"url":"https://access.redhat.com/errata/RHSA-2026:37435"},{"url":"https://access.redhat.com/errata/RHSA-2026:38878"},{"url":"https://access.redhat.com/errata/RHSA-2026:59202"},{"url":"https://access.redhat.com/errata/RHSA-2026:59203"},{"url":"https://access.redhat.com/errata/RHSA-2026:48891"},{"url":"https://access.redhat.com/errata/RHSA-2026:36510"},{"url":"https://access.redhat.com/errata/RHSA-2026:36477"},{"url":"https://access.redhat.com/errata/RHSA-2026:54773"},{"url":"https://access.redhat.com/errata/RHSA-2026:44624"},{"url":"https://access.redhat.com/errata/RHSA-2026:53520"},{"url":"https://access.redhat.com/errata/RHSA-2026:52968"},{"url":"https://access.redhat.com/errata/RHSA-2026:50931"}],"tags":["nvd","osv","go","csaf","vex","red-hat"],"epss":0.00232,"epssPercentile":0.144,"aliases":["GO-2026-4970","BIT-golang-2026-39822"],"ecosystem":"go","ingestedAt":"2026-07-09T18:56:37.033Z","slug":"CVE-2026-39822","body":"## Overview\n\nOn Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.\n\n## Affected\n\n- `go >= 1.24.0, < 1.25.12`\n- `go >= 1.26.0, < 1.26.5`\n- `go = 1.27`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `go 1.26.5`\n\n## Package advisory (CVE-2026-39822)\n\nAffected packages:\n\n- `stdlib >= 1.27.0-0, < 1.27.0-rc.2`\n\nPatched in:\n\n- `stdlib 1.27.0-rc.2`\n\nSource: https://osv.dev/vulnerability/GO-2026-4970\n\n## Vendor advisories\n\n- **RHSA-2026:66350** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66350)\n- **RHSA-2026:66375** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66375)\n- **RHSA-2026:57361** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:57361)\n- **RHSA-2026:49702** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49702)\n- **RHSA-2026:38494** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38494)\n- **RHSA-2026:37436** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37436)\n- **RHSA-2026:38995** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38995)\n- **RHSA-2026:61253** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61253)\n- **RHSA-2026:57649** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57649)\n- **RHSA-2026:49712** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49712)\n- **RHSA-2026:38493** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38493)\n- **Red Hat VEX** · Important · affected: ExternalDNS Operator, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift Container Platform 4, … · no fix planned: Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, ExternalDNS Operator, Red Hat Enterprise Linux 10, … · updated 2026-09-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39822.json)\n- **RHSA-2026:37435** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37435)\n- **RHSA-2026:38878** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38878)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":5150,"id":"CVE-2026-39822","ts":1788887250907,"field":"cvss","old":null,"new":"7.8"},{"seq":5149,"id":"CVE-2026-39822","ts":1788887250907,"field":"severity","old":"none","new":"high"},{"seq":4033,"id":"CVE-2026-39822","ts":1788886366817,"field":"cvss","old":"7.8","new":null},{"seq":4032,"id":"CVE-2026-39822","ts":1788886366817,"field":"severity","old":"high","new":"none"},{"seq":3175,"id":"CVE-2026-39822","ts":1788883133240,"field":"cvss","old":null,"new":"7.8"},{"seq":3174,"id":"CVE-2026-39822","ts":1788883133240,"field":"severity","old":"none","new":"high"}]}