Vulnerability · Published Mar 6, 2026 · Assigned by Go
CVE-2026-27139FileInfo can escape from a Root in os
Low 2.5
In plain English
A low-severity security flaw in os from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)2.5Low
Exploit odds (30 days)0.2%top 87.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | go | 1.25.8-r0 | ALPINE-CVE-2026-27139 |
| Alpine:v3.24 | go | 1.25.8-r0 | ALPINE-CVE-2026-27139 |
| Debian:12 | golang-1.19 | no fix listed | DEBIAN-CVE-2026-27139 |
| Debian:13 | golang-1.24 | no fix listed | DEBIAN-CVE-2026-27139 |
| Debian:14 | golang-1.26 | 1.26.1-1 | DEBIAN-CVE-2026-27139 |
| Go | stdlib | 1.25.8, 1.26.1 | GO-2026-4602 |
| Ubuntu:22.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2026-27139 |
| Ubuntu:24.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2026-27139 |
| Ubuntu:25.10 | golang-1.24 | no fix listed | UBUNTU-CVE-2026-27139 |
| Ubuntu:26.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2026-27139 |
| Ubuntu:22.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2026-27139 |
| Ubuntu:24.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2026-27139 |
| Ubuntu:25.10 | golang-1.25 | no fix listed | UBUNTU-CVE-2026-27139 |
| Ubuntu:26.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2026-27139 |
| Ubuntu:22.04:LTS | golang-1.26 | no fix listed | UBUNTU-CVE-2026-27139 |
| Ubuntu:24.04:LTS | golang-1.26 | no fix listed | UBUNTU-CVE-2026-27139 |
| Ubuntu:26.04:LTS | golang-1.26 | no fix listed | UBUNTU-CVE-2026-27139 |
| Ubuntu:26.10 | golang-1.26 | no fix listed | UBUNTU-CVE-2026-27139 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | os | 0 – before 1.25.81.26.0-0 – before 1.26.1 |