Repository navigation
os: Root.Mkdir(All) can follow junctions out of the root on Windows #81739
Description
On Windows, when the target of Root.Mkdir or Root.MkdirAll was a junction
pointing to an empty location, the operation would create a directory at
the junction target even when that target was located outside the root.
This only applies to operations where the last path component is a
junction (path/to/junction, but not path/junction/target).
Root.Mkdir and Root.MkdirAll now correctly avoid resolving junctions.
Thanks to Daniele Ballarini for reporting this issue.
This is CVE-2026-56857 and Go issue https://go.dev/issue/81739.
This was a PRIVATE track issue originally tracked in http://b/533399726.
Activity
thatnealpatel commentedon Sep 30, 2026
@gopherbot Please open backports for this security issue.
gopherbot commentedon Sep 30, 2026
Backport issue(s) opened: #81897 (for 1.26), #81898 (for 1.27).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847029 mentions this issue:
[release-branch.go1.27] os: correct Root junction handling on Windows (avoid mkdir escape)gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847109 mentions this issue:
[release-branch.go1.26] os: correct Root junction handling on Windows (avoid mkdir escape)[release-branch.go1.27] os: correct Root junction handling on Windows…
[release-branch.go1.26] os: correct Root junction handling on Windows…
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847305 mentions this issue:
os: correct Root junction handling on Windows (avoid mkdir escape)os: correct Root junction handling on Windows (avoid mkdir escape)
[-]security: fix CVE-2026-56857[/-][+]os: Root.Mkdir(All) can follow junctions out of the root on Windows[/+]