CVE-2026-56857: CWE-1386: Insecure Operation on Windows Junction / Mount Point in Go standard library os

On Windows, the Go standard library's os package has a vulnerability (CVE-2026-56857) related to insecure handling of junctions or mount points during directory creation operations (Root.Mkdir or Root.MkdirAll). When the target path's last component is a junction pointing to an empty location, the operation can create directories outside the intended root directory. This behavior violates expected path confinement and may lead to unauthorized directory creation outside the root. The issue affects versions >=0 <1.26.9 and >=1.27.0 <1.27.2 of the Go standard library os package.

The vulnerability allows directory creation outside the intended root directory when the target is a junction pointing to an empty location. This could lead to unauthorized filesystem modifications outside of expected boundaries, potentially impacting application security or integrity. No known exploits are reported in the wild. The impact is limited to Windows platforms and specific Go versions.

No explicit patch links or vendor advisory details are provided. Patch status is not yet confirmed — check the official Go project advisory or release notes for current remediation guidance. Until a fix is confirmed, avoid using Root.Mkdir or Root.MkdirAll on paths where the last component is a junction pointing to an empty location on Windows.