CVE-2026-32282

Katalog CVE

CVSS 6.4 · Medium EPSS 0,29%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada golang go. Skor CVSS 3.1 6.4 (Medium) menurut NVD.

Deskripsi (NVD)

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.

Rincian

Terbit di NVD

8 April 2026

Terakhir diubah

25 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.4 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 20,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://pkg.go.dev/vuln/GO-2026-4864 advisory vendor
• https://go.dev/cl/763761 patch
• https://go.dev/issue/78293 issue tracking
• https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU mailing list · release notes