Threats Tagged 'ghsa-c3q7-m35p-9qq7'

CVE-2026-56857 is a critical vulnerability in the Go standard library's os package affecting Windows systems. It involves insecure operations on Windows junctions or mount points during directory creation with Root.Mkdir or Root.MkdirAll. Specifically, when the last path component is a junction pointing to an empty location, these functions can create directories at the junction target even if it lies outside the intended root directory. This behavior can lead to unauthorized directory creation outside the expected path boundaries.