CVE-2026-27139

Vulnerability

Overview

CVE-2026-27139 is a time-of-check/time-of-use (TOCTOU) race condition in Go's os package on Unix platforms. When listing directory contents using File.ReadDir or File.Readdir, the returned FileInfo is populated via lstat. An attacker who can replace the directory with a symlink between the directory read and the lstat call can cause the FileInfo to reference a file outside the Root in which the file was opened [2].

Exploitation

Prerequisites

Exploitation requires the attacker to have write access to the directory being listed, allowing them to atomically replace it with a symlink pointing to an arbitrary path. The race window is small but exploitable. No authentication is needed beyond the ability to modify the filesystem within the root [2].

Impact

The impact is limited to reading metadata (file existence, size, permissions, etc.) from arbitrary locations on the filesystem via lstat. The attacker cannot read or write file contents outside the root. This could be used to probe for the presence or absence of files or glean metadata like file sizes [2][3].

Mitigation

The vulnerability is fixed in Go 1.25.8 and Go 1.26.1. Users should update to these versions. No workaround is available other than avoiding the use of File.ReadDir/File.Readdir on directories that could be manipulated by untrusted users [2][3].