On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.
CVSS Details
- CVSS 3.1 Base Score: 2.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go | Mar 9, 2026 | Mar 6, 2026 |
| Amazon Linux Ami 2 | — | Upgrade nerdctlUpgrade runcUpgrade golang-binUpgrade containerd-stressUpgrade golist-debuginfoUpgrade ecs-initUpgrade golang-docsUpgrade runfinch-finchUpgrade golang-sharedUpgrade amazon-ecr-credential-helper-debuginfoUpgrade amazon-ecr-credential-helperUpgrade amazon-cloudwatch-agentUpgrade runc-debuginfoUpgrade oci-add-hooks-debuginfoUpgrade oci-add-hooksUpgrade soci-snapshotterUpgrade golistUpgrade golang-testsUpgrade docker-debuginfoUpgrade dockerUpgrade golang-miscUpgrade containerd-debuginfoUpgrade nerdctl-debuginfoUpgrade golang-srcUpgrade containerdUpgrade golang | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade golang-github-burntsushi-toml-debuginfoUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golang-github-burntsushi-toml-test-develUpgrade golang-github-cpuguy83-md2manUpgrade golang-github-burntsushi-toml-testUpgrade rclone-debuginfoUpgrade rclone-debugsourceUpgrade containerd-stressUpgrade golang-github-cpuguy83-md2man-develUpgrade golang-docsUpgrade ecs-initUpgrade runc-debugsourceUpgrade docker-debuginfoUpgrade golang-github-burntsushi-tomlUpgrade runcUpgrade docker-debugsourceUpgrade yq-debuginfoUpgrade golangUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade runfinch-finchUpgrade runc-debuginfoUpgrade nerdctlUpgrade amazon-ecr-credential-helperUpgrade golang-srcUpgrade golistUpgrade containerdUpgrade yq-debugsourceUpgrade containerd-stress-debuginfoUpgrade containerd-debuginfoUpgrade golist-debugsourceUpgrade yqUpgrade soci-snapshotterUpgrade golist-debuginfoUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-github-burntsushi-toml-test-debugsourceUpgrade golang-github-burntsushi-toml-test-debuginfoUpgrade dockerUpgrade rcloneUpgrade oci-add-hooks-debugsourceUpgrade credentials-fetcherUpgrade golang-sharedUpgrade golang-binUpgrade oci-add-hooks-debuginfoUpgrade oci-add-hooksUpgrade golang-testsUpgrade golang-miscUpgrade golang-github-burntsushi-toml-develUpgrade golang-github-burntsushi-toml-debugsourceUpgrade containerd-debugsourceUpgrade amazon-cloudwatch-agent | Mar 27, 2026 | Mar 6, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Mar 6, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | Mar 6, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub