cmd-go up to 1.25.9/1.26.2 on Go Archive path traversal

Summaryinfo

A vulnerability has been found in cmd-go up to 1.25.9/1.26.2 on Go and classified as critical. Affected by this issue is some unknown functionality of the component Archive Handler. This manipulation causes path traversal. This vulnerability is registered as CVE-2026-39817. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical was found in cmd-go up to 1.25.9/1.26.2 on Go. Affected by this vulnerability is an unknown part of the component Archive Handler. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

The advisory is shared at go.dev. This vulnerability is known as CVE-2026-39817 since 04/07/2026. The exploitation appears to be easy. The attack can be launched remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 315061 (SUSE SLED15 / SLES15 Security Update : go1.25 (SUSE-SU-2026:1862-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.25.10 or 1.26.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (315061), EUVD (EUVD-2026-28421) and CERT Bund (WID-SEC-2026-1437). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Splunk Splunk Enterprise
• Red Hat Enterprise Linux
• Google Container-Optimized OS
• Amazon Linux 2
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• Microsoft Azure Linux
• Golang Go
• Red Hat OpenShift

Productinfo

Name

• cmd-go

Version

• 1.25.0
• 1.25.1
• 1.25.2
• 1.25.3
• 1.25.4
• 1.25.5
• 1.25.6
• 1.25.7
• 1.25.8
• 1.25.9
• 1.26.0
• 1.26.1
• 1.26.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion