VDB
CVE-2026-56857
CVE-2026-56857
PUBLISHED
CVSS 9.8 CRITICAL
Reported by Go · Published October 8, 2026
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
Risk Scores
CVSS 3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | os | 0, 1.27.0-0 |
| Go standard library | internal/syscall/windows | 0, 1.27.0-0 |
| chainguard | opencost | * |
| chainguard | aws-load-balancer-controller-fips | * |
| chainguard | trivy-operator | * |
| chainguard | kyverno-notation-aws | * |
| chainguard | crossplane-provider-aws-account-fips | * |
| chainguard | helm-fips-4 | * |
| wolfi | rancher-system-upgrade-controller | * |
| wolfi | cert-manager-webhook-pdns | * |
| chainguard | go-discover-fips | * |
| chainguard | crossplane-provider-aws-ecr | * |
| chainguard | sriov-network-device-plugin-fips | * |
| chainguard | grafana-fips-12.3 | * |
| chainguard | blob-csi-1.26 | * |
| chainguard | knative-operator-fips-1.20 | * |
| chainguard | kubernetes-csi-driver-smb-fips | * |
| chainguard | grafana-mssql-datasource-fips | * |
| chainguard | k8s-driver-manager-fips | * |
| chainguard | atlas | * |
…and 2408 more
Timeline
- Oct 8, 2026 CVE Published
- Oct 9, 2026 EPSS Score
- Oct 9, 2026 Coalition ESS Score
- Oct 9, 2026 CVE Updated
- Oct 10, 2026 EPSS Score
- Oct 13, 2026 EPSS Score
- Oct 14, 2026 EPSS Score
- Oct 16, 2026 EPSS Score
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score