On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golangUpgrade golang-miscUpgrade golang-testsUpgrade podmanUpgrade podman-remoteUpgrade golang-srcUpgrade golang-raceUpgrade buildahUpgrade podman-pluginsUpgrade golang-binUpgrade golang-docsUpgrade go-toolsetUpgrade delveUpgrade podman-testsUpgrade podman-dockerUpgrade buildah-tests | Jul 13, 2026 | Jul 9, 2026 |
| Alpine Linux | — | Upgrade go | Sep 7, 2026 | Jul 8, 2026 |
| Amazon Linux Ami 2 | — | Upgrade golang-testsUpgrade golistUpgrade golang-sharedUpgrade runfinch-finchUpgrade golang-srcUpgrade golang-miscUpgrade golang-docsUpgrade amazon-cloudwatch-agentUpgrade golang-binUpgrade golist-debuginfoUpgrade golang | Jul 22, 2026 | Jul 22, 2026 |
| Amazon_linux_2023 | — | Upgrade golangUpgrade golang-srcUpgrade golang-github-burntsushi-toml-test-debuginfoUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade credentials-fetcherUpgrade golang-github-burntsushi-toml-test-debugsourceUpgrade golang-github-burntsushi-toml-develUpgrade golang-github-burntsushi-toml-debugsourceUpgrade golang-miscUpgrade golistUpgrade golist-debuginfoUpgrade golist-debugsourceUpgrade golang-github-burntsushi-toml-debuginfoUpgrade golang-github-cpuguy83-md2man-develUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golang-sharedUpgrade runfinch-finchUpgrade golang-github-cpuguy83-md2manUpgrade golang-github-burntsushi-toml-testUpgrade golang-testsUpgrade golang-docsUpgrade golang-github-burntsushi-toml-test-develUpgrade golang-github-burntsushi-tomlUpgrade golang-binUpgrade amazon-cloudwatch-agent | Jul 21, 2026 | Jul 8, 2026 |
| Redhat Openshift | — | Upgrade openshift | Aug 26, 2026 | Jul 8, 2026 |
| Redhat_linux | — | Upgrade podman-dockerUpgrade golang-srcUpgrade podman-plugins-debuginfoUpgrade buildah-testsUpgrade delve-debuginfoUpgrade podman-debugsourceUpgrade go-toolsetUpgrade podman-testsUpgrade delveUpgrade golang-docsUpgrade golang-testsUpgrade podman-pluginsUpgrade golangUpgrade buildah-debugsourceUpgrade golang-binUpgrade golang-miscUpgrade podmanUpgrade buildah-tests-debuginfoUpgrade delve-debugsourceUpgrade buildah-debuginfoUpgrade podman-remoteUpgrade podman-debuginfoUpgrade podman-remote-debuginfoUpgrade buildahUpgrade podman-tests-debuginfoUpgrade golang-race | Jul 14, 2026 | Jul 8, 2026 |
| Rocky_linux | — | Upgrade buildah-debuginfoUpgrade podmanUpgrade buildahUpgrade podman-testsUpgrade buildah-testsUpgrade golangUpgrade delve-debugsourceUpgrade podman-tests-debuginfoUpgrade podman-remoteUpgrade podman-debuginfoUpgrade golang-binUpgrade go-toolsetUpgrade delve-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-plugins-debuginfoUpgrade golang-raceUpgrade buildah-debugsourceUpgrade delveUpgrade podman-debugsourceUpgrade podman-pluginsUpgrade podman-remote-debuginfo | Jul 14, 2026 | Jul 13, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 13, 2026 | Jul 8, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub