The vulnerability allows a Unix system that uses Go’s standard library os package to escape a constrained root context when the final component of the path is a symbolic link ending with a trailing slash. The resolution of the path follows the symlink outside the intended root, providing an attacker the ability to read or modify files that should be protected, thereby undermining confidentiality and integrity. This flaw is identified as a path traversal weakness (CWE‑59, CWE‑61).

All Go releases that have not yet applied the patch identified as GO‑2026‑4970 are vulnerable. Any Go application that imports or relies on os.Root.Open on Unix environments could be exposed when code constructs paths ending with a trailing slash to a symlink resolved through os.Root.Open.

The CVSS score of 7.8 indicates high severity. The EPSS score is reported as < 1%, meaning exploitation probability is very low but not zero. The vulnerability is not listed in CISA KEV. A likely attack scenario requires an attacker to influence the path argument provided to os.Root.Open—this is plausible in applications that accept user‑controlled or externally supplied file paths. Once the path is resolved via the symlink and read or modifies files outside the intended root, it can lead to compromise of application data and escalation of privileges if the application runs with elevated rights.