The vulnerability is a path traversal flaw (CWE‑59) and an improper use of root path (CWE‑1386) that occurs when the Go runtime's Root.Mkdir or Root.MkdirAll functions are called on Windows with a path whose last component is a junction pointing to an empty target. Instead of limiting creation to the intended root directory, the operation creates a directory at the junction target, allowing a program to create files or directories outside the protected area.

Affected software includes the Go standard library packages internal/syscall/windows and os when executing on Windows. The bug is exercised through the exported Root.Mkdir and Root.MkdirAll APIs. The CVE record does not specify any version constraints, so any Go build that contains the current implementation on Windows may be impacted.

The CVSS score of 9.8 indicates high severity, and the EPSS score of less than 1 % suggests very low exploitation probability. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires the attacker to supply a path that terminates in a junction, and the function will create a directory at the junction’s target even if that target lies outside the specified root. The risk level depends on whether such calls are present in the application.