Live › vulnerability › CVE-2026-56857
Go to dashboardGo's os.Root Mkdir and MkdirAll on Windows can follow a junction at the final path component and create a directory at the junction's target even when that target lies outside the root. An attacker who can plant or control a junction inside the root can create directories anywhere the Go process has write access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| stdlib | go | >= 1.27.0-0, < 1.27.2 | 1.26.9, 1.27.2 |
1.26.9 or go1.27.x before 1.27.2 on Windows; run go version -m <binary> or go version to see the toolchainUpgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild Windows binaries.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
This page as .md · .json · in your agent: get_signal("CVE-2026-56857")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.