High [CVE-2026-39822] Go os.Root: Symlink following vulnerability allows directory traversal

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.

Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash.

When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.

A flaw was found in Go's os.Root implementation. This is because `openat()` with `O_NOFOLLOW` does not prevent symlink resolution when the path has a trailing /.

An attacker able to create symlinks within an os.Root directory could use this to read or write files outside the intended root. Go versions prior to 1.24 are not affected.

This issue is fixed in Go 1.25.12 and Go 1.26.5. The following symbols are affected: * `OpenInRoot`: Opens a file or directory within an `os.Root`. * `Root.

Create`: Creates a file inside an `os.Root`. * `Root. Open`: Opens a path relative to an `os.Root`. * `Root.