File Handling Vulnerability in Go Programming Language by Google

CVE-2026-39817

What is CVE-2026-39817?

The 'pack' subcommand in the Go programming language allows users to extract archive files, but it lacks proper sanitization of output filenames. This can lead to the extraction of files to unintended locations on the filesystem when handling maliciously crafted archives. Such behavior poses a significant risk, as attackers can manipulate the environment to overwrite sensitive files or execute unauthorized actions. Developers are advised to review their usage of the 'pack' command and implement proper validation measures to mitigate potential exploitation risks.

References