CVE-2026-27139

EUVD-2026-10087
On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
2.5 LOW
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 10%
Affected Products (NVD)
VendorProductVersion
golanggo
𝑥
< 1.25.8
golanggo
1.26.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
golang-1.15
bullseye
postponed
golang-1.19
bookworm
no-dsa
golang-1.24
trixie
no-dsa
golang-1.25
forky
1.25.12-1
fixed
sid
1.25.12-1
fixed
golang-1.26
forky
1.26.5-1
fixed
sid
1.26.5-1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
amazon-cloudwatch-agent
Amazon Linux 2
0:1.300064.2-1.amzn2
fixed
Amazon Linux 2023
0:1.300064.2-1.amzn2023
fixed
amazon-ecr-credential-helper
Amazon Linux 2023
0:0.12.0-1.amzn2023
fixed
compat-golang-github-cpuguy83-md2man-2-devel
Amazon Linux 2023
0:2.0.2-24.amzn2023.0.7
fixed
containerd
Amazon Linux 2023
0:2.2.1-1.amzn2023.0.2
fixed
containerd-debuginfo
Amazon Linux 2023
0:2.2.1-1.amzn2023.0.2
fixed
containerd-debugsource
Amazon Linux 2023
0:2.2.1-1.amzn2023.0.2
fixed
containerd-stress
Amazon Linux 2023
0:2.2.1-1.amzn2023.0.2
fixed
containerd-stress-debuginfo
Amazon Linux 2023
0:2.2.1-1.amzn2023.0.2
fixed
credentials-fetcher
Amazon Linux 2023
0:2.0.1-1.amzn2023.0.1
fixed
docker
Amazon Linux 2023
0:25.0.14-1.amzn2023.0.3
fixed
docker-debuginfo
Amazon Linux 2023
0:25.0.14-1.amzn2023.0.3
fixed
docker-debugsource
Amazon Linux 2023
0:25.0.14-1.amzn2023.0.3
fixed
ecs-init
Amazon Linux 2023
0:1.102.2-1.amzn2023
fixed
golang
Amazon Linux 2
0:1.25.8-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.25.8-1.amzn2023.0.1
fixed
golang-bin
Amazon Linux 2
0:1.25.8-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.25.8-1.amzn2023.0.1
fixed
golang-docs
Amazon Linux 2
0:1.25.8-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.25.8-1.amzn2023.0.1
fixed
golang-github-burntsushi-toml
Amazon Linux 2023
0:1.5.0-1.amzn2023.0.1
fixed
golang-github-burntsushi-toml-debuginfo
Amazon Linux 2023
0:1.5.0-1.amzn2023.0.1
fixed
golang-github-burntsushi-toml-debugsource
Amazon Linux 2023
0:1.5.0-1.amzn2023.0.1
fixed
golang-github-burntsushi-toml-devel
Amazon Linux 2023
0:1.5.0-1.amzn2023.0.1
fixed
golang-github-burntsushi-toml-test
Amazon Linux 2023
0:0.2.0-8.amzn2023.0.3
fixed
golang-github-burntsushi-toml-test-debuginfo
Amazon Linux 2023
0:0.2.0-8.amzn2023.0.3
fixed
golang-github-burntsushi-toml-test-debugsource
Amazon Linux 2023
0:0.2.0-8.amzn2023.0.3
fixed
golang-github-burntsushi-toml-test-devel
Amazon Linux 2023
0:0.2.0-8.amzn2023.0.3
fixed
golang-github-cpuguy83-md2man
Amazon Linux 2023
0:2.0.2-24.amzn2023.0.7
fixed
golang-github-cpuguy83-md2man-debuginfo
Amazon Linux 2023
0:2.0.2-24.amzn2023.0.7
fixed
golang-github-cpuguy83-md2man-debugsource
Amazon Linux 2023
0:2.0.2-24.amzn2023.0.7
fixed
golang-github-cpuguy83-md2man-devel
Amazon Linux 2023
0:2.0.2-24.amzn2023.0.7
fixed
golang-misc
Amazon Linux 2
0:1.25.8-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.25.8-1.amzn2023.0.1
fixed
golang-shared
Amazon Linux 2
0:1.25.8-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.25.8-1.amzn2023.0.1
fixed
golang-src
Amazon Linux 2
0:1.25.8-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.25.8-1.amzn2023.0.1
fixed
golang-tests
Amazon Linux 2
0:1.25.8-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.25.8-1.amzn2023.0.1
fixed
golist
Amazon Linux 2
0:0.10.1-10.amzn2.0.11
fixed
Amazon Linux 2023
0:0.10.4-12.amzn2023.0.7
fixed
golist-debuginfo
Amazon Linux 2
0:0.10.1-10.amzn2.0.11
fixed
Amazon Linux 2023
0:0.10.4-12.amzn2023.0.7
fixed
golist-debugsource
Amazon Linux 2023
0:0.10.4-12.amzn2023.0.7
fixed
nerdctl
Amazon Linux 2
0:2.2.1-1.amzn2.0.3
fixed
Amazon Linux 2023
0:2.2.1-1.amzn2023.0.3
fixed
nerdctl-debuginfo
Amazon Linux 2
0:2.2.1-1.amzn2.0.3
fixed
oci-add-hooks
Amazon Linux 2023
0:0-0.1.20200504git268e3bb.amzn2023.0.9
fixed
oci-add-hooks-debuginfo
Amazon Linux 2023
0:0-0.1.20200504git268e3bb.amzn2023.0.9
fixed
oci-add-hooks-debugsource
Amazon Linux 2023
0:0-0.1.20200504git268e3bb.amzn2023.0.9
fixed
rclone
Amazon Linux 2023
0:1.73.4-74.amzn2023
fixed
rclone-debuginfo
Amazon Linux 2023
0:1.73.4-74.amzn2023
fixed
rclone-debugsource
Amazon Linux 2023
0:1.73.4-74.amzn2023
fixed
runc
Amazon Linux 2023
0:1.3.4-3.amzn2023.0.2
fixed
runc-debuginfo
Amazon Linux 2023
0:1.3.4-3.amzn2023.0.2
fixed
runc-debugsource
Amazon Linux 2023
0:1.3.4-3.amzn2023.0.2
fixed
runfinch-finch
Amazon Linux 2023
0:1.15.1-1.amzn2023.0.1
fixed
soci-snapshotter
Amazon Linux 2023
0:0.13.0-1.amzn2023.0.1
fixed
yq
Amazon Linux 2023
0:4.47.1-12.amzn2023
fixed
yq-debuginfo
Amazon Linux 2023
0:4.47.1-12.amzn2023
fixed
yq-debugsource
Amazon Linux 2023
0:4.47.1-12.amzn2023
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
golang
Azure Linux 3.0
0:1.2.58-1.azl3
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://go.dev/cl/749480
https://go.dev/issue/77827
https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
https://pkg.go.dev/vuln/GO-2026-4602