Vulnerability Description
On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Golang | Go | < 1.25.8 |
Related Weaknesses (CWE)
References
- https://go.dev/cl/749480Mailing List
- https://go.dev/issue/77827Issue Tracking
- https://groups.google.com/g/golang-announce/c/EdhZqrQ98hkRelease Notes
- https://pkg.go.dev/vuln/GO-2026-4602Vendor Advisory
FAQ
What is CVE-2026-27139?
CVE-2026-27139 is a vulnerability with a CVSS score of 2.5 (LOW). On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact...
How severe is CVE-2026-27139?
CVE-2026-27139 has been rated LOW with a CVSS base score of 2.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-27139?
Check the references section above for vendor advisories and patch information. Affected products include: Golang Go.