Directory Listing Vulnerability in File Read Operations by Go Programming Language

CVE-2026-27139

What is CVE-2026-27139?

A directory listing vulnerability exists in the Go programming language when using File.ReadDir or File.Readdir on Unix platforms. Under certain conditions, the returned FileInfo references can inadvertently expose metadata from files located outside of the intended root directory. This allows for the retrieval of filesystem metadata from arbitrary locations, enhancing the risk of information exposure, although it does not permit direct reading or writing of files outside the designated root. Developers are advised to validate and sanitize path usage to mitigate potential exposure.

References