CVE-2026-27139: FileInfo can escape from a Root in os

Analyzed

AliasesUBUNTU-CVE-2026-27139DEBIAN-CVE-2026-27139CGA-2239-gxq7-3f22+6820 more

Published 06-03-2026Last modified 09-03-2026

Vulnerability summary

CVE-2026-27139 is a low (CVSS 2.5) vulnerability in go standard library os. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12.4% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 2.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

2.5/10

010

Low · v3.1 (CVE.org)

EPSS score

0.22%

0%100%

Low · +0.10 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

06-03-2026
PublishedVulnerability first disclosed.
09-03-2026
Last modifiedVulnerability information updated.

Description

On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.

CVSS metrics

7 scores · 7 sources · 1 version

v3.12.5

EPSS trend

Probability

0.22%

Chance of exploitation in the next 30 days

Percentile

12%

Versus all other CVEs

30-day change

Increase +0.10 pp

From 0.12% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

actions-runner-controller< 0.13.1-r4
actions-runner-controller-fips< 0.13.1-r6
addon-resizer< 1.8.23-r14
addon-resizer-fips< 1.8.23-r16
ageAll versions (No fix recorded)

agentbeat< 9.2.4-r5
agentbeat-fips< 9.2.4-r5
amass< 5.0.1-r8
amazon-cloudwatch-agent< 1.300064.1-r1
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizardAll versions (No fix recorded)
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-downloaderAll versions (No fix recorded)
amazon-cloudwatch-agent-config-downloader-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-translatorAll versions (No fix recorded)
amazon-cloudwatch-agent-config-translator-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-fips< 1.300064.1-r2
amazon-cloudwatch-agent-operator< 3.3.2-r1 | < 3.3.2-r0
amazon-cloudwatch-agent-operator-fips< 3.3.2-r2
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent< 1.300064.1-r1
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips< 1.300064.1-r2
amazon-ecs-agent< 1.102.0-r2
amazon-ecs-agent-fips< 1.102.0-r1 | < 1.102.0-r2
amazon-k8s-cni< 1.21.1-r5
amazon-k8s-cni-compat< 1.21.1-r5
amazon-k8s-cni-fips< 1.21.1-r6
amazon-k8s-cni-init< 1.21.1-r5
amazon-k8s-cni-init-compat< 1.21.1-r5
amazon-k8s-cni-init-fips< 1.21.1-r6
amazon-k8s-cni-init-fips-compat< 1.21.1-r6 | All versions (No fix recorded)
amazon-ssm-agent-ecs-exec-fips< 3.3.3270.0-r10
amazon-ssm-agent-fips< 3.3.3270.0-r10
apache-beam-java-11-sdk< 2.71.0-r3
apache-beam-java-17-sdk< 2.71.0-r3
apache-beam-java-21-sdk< 2.71.0-r3
apache-exporter< 1.0.12-r4
apisix-ingress-controller< 2.0.1-r5
apm-server-7.17< 7.17.29-r12
apm-server-8.17< 8.17.10-r8
apm-server-8.18< 8.18.8-r7
apm-server-8.19< 8.19.12-r3
apm-server-9.0< 9.0.8-r5
apm-server-9.1< 9.1.10-r3 | < 9.1.10-r4
apm-server-9.2< 9.2.6-r3
apm-server-9.3< 9.3.1-r3
apm-server-fips-7.17< 7.17.29-r12
apm-server-fips-8.17< 8.17.10-r7
apm-server-fips-8.18< 8.18.8-r7
apm-server-fips-8.19< 8.19.12-r3
apm-server-fips-9.0< 9.0.8-r6
apm-server-fips-9.1< 9.1.10-r4
apm-server-fips-9.2< 9.2.6-r3
apm-server-fips-9.3< 9.3.1-r3
argo-cd-2.14< 2.14.21-r10
argo-cd-2.14-compat< 2.14.21-r10
argo-cd-3.0< 3.0.23-r4
argo-cd-3.0-compat< 3.0.23-r4
argo-cd-3.1< 3.1.12-r6
argo-cd-3.2< 3.2.7-r2
argo-cd-3.2-compat< 3.2.7-r2
argo-cd-fips-2.14< 2.14.21-r9
argo-cd-fips-2.14-compat< 2.14.21-r9
argo-cd-fips-3.0< 3.0.23-r5
argo-cd-fips-3.0-compat< 3.0.23-r5
argo-cd-fips-3.1< 3.1.12-r5
argo-cd-fips-3.1-compat< 3.1.12-r5
argo-events< 1.9.10-r5
argo-events-fips< 1.9.10-r4
argo-rollouts< 1.8.4-r4
argo-rollouts-fips< 1.8.4-r5
argo-workflow-controller-fips-3.6< 3.6.19-r4
argo-workflow-controller-fips-3.7< 3.7.10-r5
argo-workflow-executor-fips-3.6< 3.6.19-r4
argo-workflow-executor-fips-3.7< 3.7.10-r5
argo-workflow-executor-fips-4.0< 4.0.1-r6
argo-workflows-fips-3.6< 3.6.19-r4
argo-workflows-fips-3.7< 3.7.10-r5
argocd-image-updater< 1.1.1-r3
argocd-image-updater-fips< 1.1.1-r4
atlantis< 0.40.0-r3
atlantis-fips< 0.40.0-r5
auditbeat-7< 7.17.29-r13
auditbeat-8.17< 8.17.10-r11
auditbeat-8.18< 8.18.8-r12
auditbeat-8.19< 8.19.12-r2
auditbeat-9.0< 9.0.8-r10
auditbeat-9.2< 9.2.6-r3
auditbeat-9.3< 9.3.1-r3
auditbeat-fips-7< 7.17.29-r13
auditbeat-fips-8.17< 8.17.10-r9
auditbeat-fips-8.18< 8.18.8-r10
auditbeat-fips-8.19< 8.19.12-r2
auditbeat-fips-9.0< 9.0.8-r9
auditbeat-fips-9.1< 9.1.10-r6
auditbeat-fips-9.2< 9.2.6-r2
auditbeat-fips-9.3< 9.3.1-r2
authentik-go-server< 2026.2.1-r2
authservice< 1.1.5-r4
authservice-fips< 1.1.5-r5
aws-application-networking-k8s< 2.0.1-r2
aws-application-networking-k8s-fips< 2.0.1-r3
aws-ebs-csi-driver-1.49All versions (No fix recorded)
aws-ebs-csi-driver-1.50< 1.50.3-r6
aws-ebs-csi-driver-1.51< 1.51.2-r6
aws-ebs-csi-driver-1.52< 1.52.1-r7
aws-ebs-csi-driver-1.53< 1.53.0-r6
aws-ebs-csi-driver-1.54< 1.54.0-r6
aws-ebs-csi-driver-1.55< 1.55.0-r3
aws-ebs-csi-driver-1.56< 1.56.0-r3
aws-ebs-csi-driver-fips-1.49All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.50< 1.50.3-r6
aws-ebs-csi-driver-fips-1.51< 1.51.2-r6
aws-ebs-csi-driver-fips-1.52< 1.52.1-r6
aws-ebs-csi-driver-fips-1.53< 1.53.0-r6
aws-ebs-csi-driver-fips-1.54< 1.54.0-r5
aws-ebs-csi-driver-fips-1.55< 1.55.0-r4
aws-ebs-csi-driver-fips-1.56< 1.56.0-r3
aws-efs-csi-driver-fips< 2.3.0-r5
aws-eks-pod-identity-agent< 0.1.36-r6
aws-eks-pod-identity-agent-fips< 0.1.36-r5
aws-flb-cloudwatch-fips< 1.9.4-r21
aws-flb-firehose-fips< 1.7.2-r20
aws-flb-kinesis< 1.10.3-r7
aws-flb-kinesis-fips< 1.10.3-r8
aws-fsx-csi-driver< 1.8.0-r4
aws-fsx-csi-driver-fips< 1.8.0-r4
aws-iam-authenticator< 0.7.11-r2
aws-iam-authenticator-fips< 0.7.11-r2
aws-load-balancer-controller< 3.1.0-r2
aws-load-balancer-controller-fips< 3.1.0-r1
aws-network-policy-agent-fips< 1.3.1-r4 | < 1.3.1-r5
aws-node-termination-handler-fips< 1.25.5-r1
aws-nuke< 3.64.0-r3
aws-nuke-fips< 3.64.0-r2
aws-otel-collector< 0.47.0-r7
aws-otel-collector-fips< 0.47.0-r4
aws-otel-collector-healthcheck< 0.47.0-r7
aws-otel-collector-healthcheck-fips< 0.47.0-r4
aws-privateca-issuer< 1.8.0-r8
aws-privateca-issuer-fips< 1.8.0-r6
aws-s3-controller< 1.3.1-r4
aws-signer-notation-plugin< 1.0.2292-r14
aws-signer-notation-plugin-fips< 1.0.2292-r8
aws-sigv4-proxy< 1.11.1-r5
aws-sigv4-proxy-fips< 1.11.1-r3
azcopy< 10.32.1-r7
azcopy-fips< 10.32.1-r3
azure-aad-pod-identity-mic< 1.8.17-r34
azure-aad-pod-identity-nmi< 1.8.17-r34
azure-ipam< 0.4.0-r15
azure-ipam-dropgz< 0.4.0-r15
azure-service-operator< 2.18.0-r4
azure-service-operator-fips< 2.18.0-r3
azure-vnet-cni< 1.7.12-r3
azure-workload-identity-webhook< 1.5.1-r14
azuredisk-csi-1.28< 1.28.12-r16
azuredisk-csi-1.29< 1.29.14-r15
azuredisk-csi-1.30< 1.30.12-r14
azuredisk-csi-1.31< 1.31.12-r10
azuredisk-csi-1.32< 1.32.12-r4
azuredisk-csi-1.33< 1.33.8-r5
azuredisk-csi-1.34< 1.34.2-r3
azuredisk-csi-fips-1.28< 1.28.12-r15
azuredisk-csi-fips-1.29< 1.29.14-r14
azuredisk-csi-fips-1.30< 1.30.12-r13
azuredisk-csi-fips-1.31< 1.31.12-r10
azuredisk-csi-fips-1.32< 1.32.12-r4
azuredisk-csi-fips-1.33< 1.33.8-r5
azuredisk-csi-fips-1.34< 1.34.2-r2
azurefile-csi-1.29All versions (No fix recorded)
azurefile-csi-1.30All versions (No fix recorded)
azurefile-csi-1.31< 1.31.8-r11
azurefile-csi-1.32< 1.32.9-r7
azurefile-csi-1.33< 1.33.8-r2
azurefile-csi-1.34< 1.34.4-r2
azurefile-csi-1.35< 1.35.1-r5
azurefile-csi-fips-1.29All versions (No fix recorded)
azurefile-csi-fips-1.30All versions (No fix recorded)
azurefile-csi-fips-1.31< 1.31.8-r12
azurefile-csi-fips-1.32< 1.32.9-r6
azurefile-csi-fips-1.33< 1.33.8-r2
azurefile-csi-fips-1.34< 1.34.4-r2
azurefile-csi-fips-1.35< 1.35.1-r2
backup-restore-operator-7.0< 7.0.5-r4
backup-restore-operator-8.1< 8.1.2-r3
backup-restore-operator-9.0< 9.0.1-r4
backup-restore-operator-fips-7.0< 7.0.5-r4
backup-restore-operator-fips-8.1< 8.1.2-r4
backup-restore-operator-fips-9.0< 9.0.1-r4
bank-vaults< 1.32.1-r6
bank-vaults-fips< 1.32.1-r2
bank-vaults-template< 1.32.1-r6
bank-vaults-template-fips< 1.32.1-r2
bento-fips< 1.15.1-r0
blob-csi-1.23< 1.23.11-r66
blob-csi-1.24< 1.24.11-r15
blob-csi-1.25< 1.25.10-r12
blob-csi-1.26< 1.26.10-r2
blob-csi-1.27< 1.27.3-r2
blob-csi-fips-1.23< 1.23.11-r68

Show all 199

Alpine1 product

go< 1.25.8-r0

2 vendors · 200 products · Showing 200 of 3635

References

12 links

groups.google.com/g/golang-announce/c/EdhZqrQ98hkREPORTWEBRelease Notes
go.dev/issue/77827REPORTWEBIssue Tracking
go.dev/cl/749480REPORTWEBFIXMailing List
pkg.go.dev/vuln/GO-2026-4602REPORTWEBVendor Advisory
ubuntu.com/security/CVE-2026-27139REPORT
www.cve.org/CVERecord?id=CVE-2026-27139REPORT
github.com/golang/go/issues/77827REPORT
security-tracker.debian.org/tracker/CVE-2026-27139Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27139.jsonAdvisory

Show all 12 references

nvd.nist.gov/vuln/detail/CVE-2026-27139AdvisoryOval
security.alpinelinux.org/vuln/CVE-2026-27139Advisory