CVE-2026-27139

Katalog CVE

CVSS 2.5 · Low EPSS 0,12%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada golang go. Skor CVSS 3.1 2.5 (Low) menurut CISA ADP.

Deskripsi (NVD)

On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.

Rincian

Terbit di NVD

6 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

2.5 (Low), sumber CISA ADP
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,12% peluang dieksploitasi; lebih tinggi dari 1,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://pkg.go.dev/vuln/GO-2026-4602 advisory vendor
• https://go.dev/cl/749480 mailing list
• https://go.dev/issue/77827 issue tracking
• https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk release notes