CVE-2026-56857: Root.Mkdir(All) can follow junctions out of the root on Windows in os
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
Other sources
Root.Mkdir(All) can follow junctions out of the root on Windows in os
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/dockerto a version that resolves this vulnerability.Fixed in 29.9.0-r0 - Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.26.9-r0
Event History
Frequently Asked Questions
How can I determine whether my code is exposed to this behavior?
Review Windows code paths that call Root.Mkdir or Root.MkdirAll where the final path component may be a junction. Exposure requires that the junction point to an empty location outside the intended root.
Are directory creations below a junction also affected?
No. The issue applies when the junction is the last path component, such as path/to/junction, and not when creating a descendant such as path/junction/target.