{"id":"CVE-2026-56857","published":"2026-10-08T23:17:01Z","modified":"2026-10-09T16:35:35Z","title":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation…","vendor":"Go standard library","product":"os","tier":"core","eol":null,"description":{"text":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).","provenance":"source","from":"NVD"},"summary":{"text":"On Windows, the os package's Root.Mkdir and Root.MkdirAll functions in the Go standard library can mishandle a junction whose target is an empty location: when the last path component is a junction, the operation may create a directory at the junction's target even though that target lies outside the root. An attacker who can place or control such a junction within the root can cause directories to be created outside it, with the flaw triggered simply by calling these functions on the affected path, not through a particular configuration or user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:18:26Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00553,"percentile":0.46205,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":12,"pulses":[{"name":"Known_Cve | Oct 21, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad781365a703b9c48649e66","created":"2026-10-20"},{"name":"Known_Cve | Oct 20, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad62f6910d6449918d5e634","created":"2026-10-19"},{"name":"Known_Cve | Oct 19, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad4dda86020bf504fd274dd","created":"2026-10-18"},{"name":"Known_Cve | Oct 18, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad38c282daff94afd324191","created":"2026-10-17"},{"name":"Known_Cve | Oct 17, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad23ab08ed96f8b8bdea241","created":"2026-10-16"},{"name":"Known_Cve | Oct 16, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ad0e933fc9a5a47b66d7921","created":"2026-10-15"},{"name":"Known_Cve | Oct 15, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6acf98726e4260f2f2ba3d49","created":"2026-10-14"},{"name":"Known_Cve | Oct 14, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ace4672cf606a4598005652","created":"2026-10-13"},{"name":"Known_Cve | Oct 13, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6accf72a849f791bc729312a","created":"2026-10-12"},{"name":"Known_Cve | Oct 12, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6acba8aca71285f9db866402","created":"2026-10-11"}],"provenance":"machine"},"cwes":[{"id":"CWE-1386","name":"Insecure Operation on Windows Junction / Mount Point"}],"references":[{"url":"https://go.dev/cl/847305","tags":[]},{"url":"https://go.dev/issue/81739","tags":[]},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","tags":[]},{"url":"https://pkg.go.dev/vuln/GO-2026-6604","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Go","package":"stdlib","vulnerableRanges":["<1.26.9",">=1.27.0-0, <1.27.2"],"patched":["1.26.9","1.27.2"],"from":["GO-2026-6604"],"provenance":"source"}],"advisories":[{"id":"GO-2026-6604","url":"https://osv.dev/vulnerability/GO-2026-6604","severity":null,"ecosystem":"Go","package":"stdlib","vulnerableRanges":["<1.26.9",">=1.27.0-0, <1.27.2"],"patched":["1.26.9","1.27.2"],"provenance":"source","from":"OSV"}],"euvd":{"id":"EUVD-2026-95420","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-95420","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-08","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56857","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":18.6,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":9.24,"detail":"percentile 0.4621"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.53,"detail":"12 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}