GO-2026-6604

Dashboard / Vulnerabilities / GO-2026-6604

GO-2026-6604

Summary: Root.Mkdir(All) can follow junctions out of the root on Windows in os

Details: On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

References: https://go.dev/cl/847305, https://go.dev/issue/81739, https://groups.google.com/g/golang-announce/c/U2fTuyDJznI