Description
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Go standard library / internal/syscall/windows0 – 1.26.9
- Go standard library / internal/syscall/windows1.27.0-0 – 1.27.2
- Go standard library / os0 – 1.26.9
- Go standard library / os1.27.0-0 – 1.27.2
Updated 16m ago · 8 sources