Low severity · published Mar 6, 2026
CVE-2026-27139
FileInfo can escape from a Root in os
2.5
CVSS
0.2%
EPSS
No
On KEV
Description
On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
os · Go standard library
before 1.25.8; 1.26.0-0 before 1.26.1 · source: vendor
GO
GO · Golang
before 1.25.8; 1.26.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27139
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27139
Mailing List
https://go.dev/cl/749480
Issue Tracking
https://go.dev/issue/77827
Release Notes
https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
Vendor Advisory
https://pkg.go.dev/vuln/GO-2026-4602
More from os
9.8
CVE-2026-56857
Root.Mkdir(All) can follow junctions out of the root on Windows in os
7.8
CVE-2026-39822
Root escape via symlink plus trailing slash in os