Path traversal in Go programming language - CVE-2026-39817
Published: July 31, 2026
Vulnerability identifier: #VU140613
CSH Severity: Medium
CVSS v4 BT: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2026-39817
CWE-ID: CWE-22
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to write files to arbitrary locations on the filesystem.
The vulnerability exists due to improper neutralization of path elements in output filenames in the "go tool pack" subcommand when extracting a malicious archive file. A local user can supply a specially crafted archive file to write files to arbitrary locations on the filesystem.
Affected software
Go programming language
How to mitigate CVE-2026-39817
Install security update from vendor's website.
Go programming language - addressed in versions 1.25.10, 1.26.3