---
id: CVE-2026-56857
title: >-
  On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction
  pointing to an empty location, the operation can create a directory at the
  junction target even when that target is located outside the root
summary: >-
  On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction
  pointing to an empty location, the operation can create a directory at the
  junction target even when that target is located outside the root. This only
  applies to o…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-1386
  - CWE-59
vendor: stdlib
product: stdlib
affected:
  - 'stdlib >= 1.27.0-0, < 1.27.2'
patched:
  - stdlib 1.27.2
published: '2026-10-08'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T16:35:35.900'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56857'
references:
  - url: 'https://go.dev/cl/847305'
    label: security@golang.org
  - url: 'https://go.dev/issue/81739'
    label: security@golang.org
  - url: 'https://groups.google.com/g/golang-announce/c/U2fTuyDJznI'
    label: security@golang.org
  - url: 'https://pkg.go.dev/vuln/GO-2026-6604'
    label: security@golang.org
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56857.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-56857'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2548348'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-56857'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56857'
tags:
  - nvd
  - osv
  - go
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
aliases:
  - GO-2026-6604
  - BIT-golang-2026-56857
ecosystem: go
scores:
  nvd: 9.8
  vendor: 3.3
  adp: 9.8
ingestedAt: '2026-10-09T00:19:50.973Z'
epss: 0.00553
epssPercentile: 0.46025
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-09T15:35:58.663117Z'
---

## Overview

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-56857)

Affected packages:

- `stdlib >= 1.27.0-0, < 1.27.2`

Patched in:

- `stdlib 1.27.2`

Source: https://osv.dev/vulnerability/GO-2026-6604

## Vendor advisories

- **Red Hat VEX** · Low · affected: OpenShift Developer Tools and Services, OpenShift Pipelines, OpenShift Serverless, OpenShift Service Mesh 3, Red Hat AMQ Clients, Red Hat Edge Manager 1, … · no fix planned: OpenShift Developer Tools and Services, Red Hat Service Interconnect 2, streams for Apache Kafka 2, OpenShift Pipelines, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56857.json)