UBUNTU-CVE-2026-97042: Path Traversal
Building a malicious package that uses "//go:cgoimportdynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgoimportdynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l<name>" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in "//go:cgoimportdynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Windows build environments that compile an untrusted or malicious Go package, or link against a crafted PE object file, are the relevant exposure scenario. The affected Ubuntu packages listed are golang-1.6, 1.8, 1.10, 1.13, 1.16, 1.18, 1.22, and 1.24.
What must an attacker control to exploit this?
An attacker needs to supply source containing a malicious //go:cgo_import_dynamic directive or a crafted PE object with malicious imported DLL names. Exploitation occurs when the package or object is processed in a Windows build path that passes library arguments to an external linker.
What input patterns should be treated as suspicious while remediation is pending?
Reject or inspect cgo directives and PE imported DLL names containing path separators, "..", or ":", as well as names beginning with "-" or "@". These values can cause unsafe -l<name> arguments and may reference arbitrary files on disk.