CVE-2026-66897: Go Os Root Unconfined Filesystem Escape
Filesystem operations should be performed using `os.Root` methods (e.g., `OpenFile`, `Create`) rather than joining `root.Name()` with paths and passing them to unconfined `os` package functions. Operating on raw paths bypasses directory confinement and allows path traversal or symlink escapes.
Gogreprules fetch cve-2026-66897-go-os-root-unconfined-filesystem-escape --engine opengrepDescription
Filesystem operations should be performed using `os.Root` methods (e.g., `OpenFile`, `Create`) rather than joining `root.Name()` with paths and passing them to unconfined `os` package functions. Operating on raw paths bypasses directory confinement and allows path traversal or symlink escapes.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.