A flaw exists in Go's os.Root implementation on Unix systems where the Open function improperly follows symbolic links when the path ends with a trailing slash. This occurs because the underlying openat() system call with O_NOFOLLOW does not prevent symlink resolution in this case. An attacker able to create symlinks inside an os.Root directory can exploit this to read or write files outside the intended root directory, potentially leading to information disclosure or unauthorized file modification. The os.Root API was introduced in Go 1.24; versions prior to 1.24 are not affected. The issue is fixed in Go 1.25.12 and Go 1.26.5. Affected functions include OpenInRoot, Root.Create, Root.Open, Root.OpenFile, Root.OpenRoot, Root.ReadFile, and Root.WriteFile.

The vulnerability allows an attacker with the ability to create symbolic links within an os.Root directory to bypass directory restrictions and access or modify files outside the intended root. This can lead to information disclosure, unauthorized file system access, and potential bypass of security mechanisms relying on file system isolation. The impact is rated high due to the potential for confidentiality, integrity, and availability impacts.

The vendor advisory states there is no mitigation other than updating the Go toolchain to version 1.25.12 or 1.26.5. Programs compiled with Go versions prior to 1.24 or those not using the os.Root API are not affected. Users should upgrade their Go toolchain to one of the fixed versions to remediate this vulnerability.