Go Standard Library OS
5 CVEs affecting Go Standard Library OS. Latest disclosed: 2026-07-08. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39822 | High | 7.8 | 2026-07-08 | On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a sym… |
CVE-2022-41720 | High | 7.5 | 2022-12-07 | On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a g… |
CVE-2025-0913 | Medium | 5.5 | 2025-06-11 | os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile wi… |
CVE-2025-22873 | Low | 3.8 | 2026-02-04 | It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the par… |
CVE-2026-27139 | Low | 2.5 | 2026-03-06 | On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root… |