IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
9.8Kritisch

CVE-2026-56857Root.Mkdir(All) can follow junctions out of the root on Windows in os

Go standard library os; Go standard library internal/syscall/windows Veröffentlicht: (vor 1 Monat)

Beschreibung

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

Schwachstellentyp (CWE): CWE-1386

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Go standard library internal/syscall/windows < 1.26.9, 1.27.0-0 – < 1.27.2
Go standard library os < 1.26.9, 1.27.0-0 – < 1.27.2

Referenzen und Patches

Neue CVEs im selben Produkt — Go

Ohne Score
CVE-2026-97054

HTTP/1 server crash due to MaxBytesReader header race in net/http

Go standard library net/http

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes …