中文

// CVE · PUBLISHED 2026-10-08

CVE-2026-56857

Go standard library / os · Go standard library / internal/syscall/windows

9.8 · CVSS 3.1Critical

Description

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

References

Related CVEs

← CVE Index: search every CVE from the last 30 days

This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.