CVE-2026-32282 Details

A vulnerability exists in the Go programming language's handling of the Root.Chmod function on Linux. If the target of a chmod operation is replaced with a symlink while the operation is ongoing, Chmod can inadvertently modify the target of the symlink, potentially affecting files outside the intended directory. This issue arises because the fchmodat system call, used by Chmod, ignores the AT_SYMLINK_NOFOLLOW flag, which is meant to prevent such symlink traversal. Although Chmod checks its target before execution and will return an error if the target is a symlink leading outside the root directory, the vulnerability can still be exploited if the target is changed to a symlink between the initial check and the execution of the command.

Users can upgrade to Go versions 1.26.2 or 1.25.9, both of which include the necessary fix. Instructions for downloading these versions are available on the Go website.