Bug 2445335 (CVE-2026-27139) - CVE-2026-27139 os: FileInfo can escape from a Root in golang os module
Summary: CVE-2026-27139 os: FileInfo can escape from a Root in golang os module
Keywords:
Status: NEW
Alias: CVE-2026-27139
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2445871
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-06 22:01 UTC by OSIDB Bzimport
Modified: 2026-03-09 21:30 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-03-06 22:01:31 UTC 
On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.
Note You need to log in before you can comment on or make changes to this bug.