Go standard library · os
On Windows, the os package's Root.Mkdir and Root.MkdirAll functions in the Go standard library can mishandle a junction whose target is an empty location: when the last path component is a junction, the operation may create a directory at the junction's target even though that target lies outside the root. An attacker who can place or control such a junction within the root can cause directories to be created outside it, with the flaw triggered simply by calling these functions on the affected path, not through a particular configuration or user interaction.
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
Disclosed on 8 Oct 2026. No public exploit code or confirmed exploitation is recorded.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: stdlib.
Upgrade to 1.27.2 or later
Fixes this CVE and 1 other known vulnerability in this package (CVE-2026-78663).
Set the version to Go 1.27.2 or later in your Go toolchain.
The first fix for CVE-2026-56857.
| If you run | Upgrade to |
|---|---|
| 1.27.0-0 up to 1.27.2 | 1.27.2 |
| All versions before 1.26.9 | 1.26.9 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.