Description
It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.
References (5)
Core 5
Core References
Patch, Product
https://go.dev/cl/670036
Issue Tracking, Vendor Advisory
https://go.dev/issue/73555
Mailing List, Release Notes
https://groups.google.com/g/golang-announce/c/UZoIkUT367A/m/5WDxKizJAQAJ
Vendor Advisory, Issue Tracking
https://pkg.go.dev/vuln/GO-2026-4403
Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2025/05/06/2
Scores
CVSS v3
3.8
EPSS
0.0024
EPSS Percentile
14.3%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-23
Status
published
Products (1)
golang/go
< 1.23.9
Published
Feb 04, 2026
Tracked Since
Feb 18, 2026