ALPINE-CVE-2026-97042: Path Traversal
Building a malicious package that uses "//go:cgoimportdynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgoimportdynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l<name>" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in "//go:cgoimportdynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.26.11-r0
Event History
Frequently Asked Questions
Who is exposed to this issue?
The issue affects Windows builds that invoke the external linker and process either malicious //go:cgo_import_dynamic directives or crafted PE object files. It is relevant when building untrusted or attacker-controlled package source or object inputs.
What does an attacker need to exploit it?
An attacker needs to cause a Windows Go build to use a malicious package containing a crafted //go:cgo_import_dynamic directive, or to link a crafted PE object with malicious imported DLL names. The crafted library or DLL name can use path traversal or special characters to influence external-linker library arguments.
Are cgo-generated files affected?
Yes. The prior compiler validation skipped cgo-generated files, including on Windows, allowing unsafe library names in those inputs.
What input should be blocked if patching is not immediately possible?
Do not build untrusted Go packages or link untrusted PE object files on Windows where the external linker may be used. In particular, reject inputs with library or imported DLL names containing "..", path separators, ":", or names beginning with "-" or "@".