Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Go file listing may expose data outside target folder
published 8 months ago
Summary
Programs written in the Go language that list directory contents on Unix systems can unintentionally retrieve information about files located anywhere on the server, not just the intended folder. This lets an attacker see details such as file names, sizes, and timestamps, though they cannot read the file contents. Upgrade to the latest Go release and restart affected applications to stop the leak.
What to do
- Update bellsoft go to version 1.26.0-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Alpaquita:stream | bellsoft | go |
>= 1.20.5-r2, < 1.26.0-r0 Fix: upgrade to 1.26.0-r0
|
| BellSoft Hardened Containers:stream | bellsoft | go |
>= 1.20.5-r2, < 1.26.0-r0 Fix: upgrade to 1.26.0-r0
|
Original advisory text
BELL-CVE-2026-27139
References
- https://docs.bell-sw.com/security/cves/CVE-2026-27139 Vendor Advisory
Timeline
Published6 Mar 2026
Updated13 Mar 2026
First seen7 Mar 2026
Track software like this
Free during beta