PkgSeer

Vulnerability GO-2026-6604

Unknown

8 hours ago

Root.Mkdir(All) can follow junctions out of the root on Windows in os

<1.26.9

Summary

Root.Mkdir(All) can follow junctions out of the root on Windows in os

Details

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Reset context tracking on consecutive template expressions in html/template

<1.26.9 GO-2026-6599

Recognize yield as regexp preceder keyword in html/template

<1.26.9 GO-2026-6600

HTTP/2 server memory exhaustion due to Trailer headers in net/http

<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6603

HTTP/1 client connection desynchronization after CONNECT rejection in net/http

<1.26.9 GO-2026-6605

Reject malformed ECH outer extension references in crypto/tls

<1.26.9 GO-2026-6607

View all vulnerabilities for these packages

Impacted packages

stdlib

Timeline

Published

8 hours ago

Last Modified

8 hours ago