{"id":"CVE-2026-56857","title":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root","summary":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to o…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-1386","CWE-59"],"vendor":"stdlib","product":"stdlib","affected":["stdlib >= 1.27.0-0, < 1.27.2"],"patched":["stdlib 1.27.2"],"published":"2026-10-08","updated":"2026-10-09","sourceUpdated":"2026-10-09T16:35:35.900","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56857","references":[{"url":"https://go.dev/cl/847305","label":"security@golang.org"},{"url":"https://go.dev/issue/81739","label":"security@golang.org"},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","label":"security@golang.org"},{"url":"https://pkg.go.dev/vuln/GO-2026-6604","label":"security@golang.org"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56857.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-56857"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548348"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56857"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56857"}],"tags":["nvd","osv","go","csaf","vex","red-hat","cve.org","score-dispute"],"aliases":["GO-2026-6604","BIT-golang-2026-56857"],"ecosystem":"go","scores":{"nvd":9.8,"vendor":3.3,"adp":9.8},"ingestedAt":"2026-10-09T00:19:50.973Z","epss":0.00553,"epssPercentile":0.46025,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-09T15:35:58.663117Z"},"slug":"CVE-2026-56857","body":"## Overview\n\nOn Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-56857)\n\nAffected packages:\n\n- `stdlib >= 1.27.0-0, < 1.27.2`\n\nPatched in:\n\n- `stdlib 1.27.2`\n\nSource: https://osv.dev/vulnerability/GO-2026-6604\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: OpenShift Developer Tools and Services, OpenShift Pipelines, OpenShift Serverless, OpenShift Service Mesh 3, Red Hat AMQ Clients, Red Hat Edge Manager 1, … · no fix planned: OpenShift Developer Tools and Services, Red Hat Service Interconnect 2, streams for Apache Kafka 2, OpenShift Pipelines, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56857.json)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":218560,"id":"CVE-2026-56857","ts":1791565563176,"field":"cvss","old":"3.3","new":"9.8"},{"seq":218559,"id":"CVE-2026-56857","ts":1791565563176,"field":"severity","old":"low","new":"critical"},{"seq":218460,"id":"CVE-2026-56857","ts":1791533861975,"field":"cvss","old":null,"new":"3.3"},{"seq":218459,"id":"CVE-2026-56857","ts":1791533861975,"field":"severity","old":"none","new":"low"}]}