Improper Symlink Handling in Go's os.Root

Executive Summary

CVE-2026-39822 is a vulnerability in the Go programming language's os package on Unix systems. It occurs when opening a file within an os.Root directory if the final component of the path is a symbolic link and the path ends with a trailing slash (/). In this case, the function improperly follows the symlink even if it points outside the intended root directory.

For example, calling root.Open("symlink/") will open the target of "symlink" even if that symlink points outside the root directory. This happens because the underlying openat system call with the O_NOFOLLOW flag still follows symlinks when the path ends with a slash, and the Go implementation did not properly sanitize the path to prevent this behavior.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker or a malicious user to escape the intended root directory restrictions by exploiting symbolic links with trailing slashes. This means that code relying on os.Root to restrict file access within a certain directory could be bypassed, potentially allowing unauthorized access to files outside the designated root.

Such unauthorized access could lead to information disclosure, unauthorized file reads or writes, and compromise of system integrity depending on the permissions and context in which the vulnerable code is used.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the Go programming language's os package improperly following symbolic links when opening files in an os.Root directory if the final path component is a symlink and the path ends with a slash (/).

To detect this vulnerability on your system, you would need to identify if your Go applications use the os.Root functions (such as OpenInRoot, Root.Create, Root.Open, Root.OpenFile, Root.OpenRoot, Root.ReadFile, and Root.WriteFile) and whether they open paths ending with a trailing slash that are symbolic links pointing outside the intended root.

There are no specific commands provided in the resources to detect this vulnerability directly on your network or system.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update your Go environment to a version that includes the fix for this vulnerability.

The issue has been addressed by properly sanitizing the path parameter passed to the openat system call in the os.Root functions, preventing symlink escapes when the path ends with a slash.

Ensure that your Go version is at least the security release that fixed this issue, tracked under Go issue #79005 and marked as a security release blocker for Go 1.27.

Useful 0 Not Useful 0