Fluid Attacks Database

Description

On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	golang-1.25	=1.25.0-1 \|\| =1.25.0-2 \|\| =1.25.1-1 \|\| =1.25.2-1 \|\| =1.25.3-1 \|\| =1.25.6-1 \|\| =1.25.7-1 \|\| =1.25.7-2 \|\| >=0 <1.25.8-1	1.25.8-1
debian 11	golang-1.15	=1.15.15-1 \|\| =1.15.15-1~deb11u1 \|\| =1.15.15-1~deb11u2 \|\| =1.15.15-1~deb11u3 \|\| =1.15.15-1~deb11u4 \|\| =1.15.15-2 \|\| =1.15.15-3 \|\| =1.15.15-4 \|\| =1.15.15-5 \|\| =1.15.9-6	-
debian 13	golang-1.24	=1.24.12-1 \|\| =1.24.13-1 \|\| =1.24.13-2 \|\| =1.24.4-1 \|\| =1.24.4-2 \|\| =1.24.4-3 \|\| =1.24.4-4 \|\| =1.24.7-1 \|\| =1.24.8-1 \|\| =1.24.9-1	-
debian 12	golang-1.19	=1.19.10-1 \|\| =1.19.10-2 \|\| =1.19.11-1 \|\| =1.19.12-1 \|\| =1.19.12-2 \|\| =1.19.12-2~bpo11+1 \|\| =1.19.12-2~bpo12+1 \|\| =1.19.13-1 \|\| =1.19.13-1~bpo11+1 \|\| =1.19.13-1~bpo12+1 \|\| =1.19.8-2 \|\| =1.19.9-1	-
debian 14	golang-1.26	=1.26.0-1 \|\| =1.26~rc2-1 \|\| =1.26~rc3-1 \|\| =1.26~rc3-2 \|\| >=0 <1.26.1-1	1.26.1-1
go	stdlib	>=0 <1.25.8	1.25.8
rpm rhel10	golang	-	-
rpm rhel8	golang	-	-
rpm rhel9	golang	-	-

Aliases

1. CVE-2026-271392. NVD-2026-271393. OSV-DEBIAN-2026-271394. OSV-2026-271395. OSV-GO-2026-46026. GCVE-2026-271397. SECURITY-TRACKER-CVE-2026-27139

References

1. https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk2. https://go.dev/issue/778273. https://go.dev/cl/749480