CVE-2026-56857
EPSS 0.6%Vendor patching present but no PoC, KEV, or real-world exploitation signal; bulk announcement chatter.
What: Windows path traversal via junction symlink in Go's Root.Mkdir/MkdirAll functions, allowing directory creation outside intended root scope (CVSS/EPSS not yet assigned).
Why it matters: Go standard library flaw affecting Windows deployments. Social chatter shows rapid vendor patching (Google Apigee suite across watcher, udca, redis, prometheus-adapter, operators, cassandra-client, istiod). However, no KEV listing, no public PoC reported, no active exploitation signal. Chatter is purely vendor advisory boilerplate—bulk CVE lists in security release notes lack tactical detail or defender triage urgency.
Where it's seen: Bluesky vendor release announcements bundling CVE-2026-56857 with 10+ other CVEs per product. No independent security research, journalist coverage, or proof-of-concept discussion detected.
RISK: MODERATE — Windows-only path traversal in stdlib; patched widely but low EPSS and no exploitation evidence.
Description
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).