The vulnerability exists in the 'go tool pack' subcommand of the Go toolchain (cmd/go), which fails to properly sanitize output filenames when extracting archive files. This improper limitation of a pathname to a restricted directory (CWE-22) allows an attacker to craft a malicious archive that, when processed by the 'pack' subcommand, can write files outside the intended directory, potentially overwriting or creating files anywhere on the filesystem. The affected versions include 0 up to 1.26.0-0. There is no CVSS score or vendor advisory indicating a patch or remediation status at this time.

An attacker who can supply a malicious archive to the 'go tool pack' subcommand may cause arbitrary files to be written to locations outside the intended directory. This could lead to overwriting critical files or placing malicious files in sensitive locations. However, since the 'pack' subcommand is usually used internally by the compiler with known-good inputs, exploitation may require specific conditions or attacker control over inputs to this tool.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted archive files with the 'go tool pack' subcommand. Restrict usage of this tool to trusted inputs only.