Vulnerability in Go standard library os

[ Description ]Official description

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4093

  Oracle TimesTen In-Memory Database: Multiple vulnerabilities Translated from German

  Risk mediumCVE-2026-101600CVE-2026-39822CVE-2026-87354+1 more CVEs
• CERT-FR2 Oct 2026CERTFR-2026-AVI-1249

  Multiple vulnerabilities in VMware products Translated from French

  Multiple vulnerabilities have been discovered in VMware products. They allow an attacker to cause a security problem not specified by the vendor.

  CVE-2026-75595CVE-2026-53910CVE-2026-56404+288 more CVEs

[ References ]References

• go.dev/issue/79005
• groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc
• go.dev/cl/797880
• pkg.go.dev/vuln/GO-2026-4970