CVE-2026-39822 Root escape via symlink plus trailing slash in os

[
  {
    "vendor": "Go standard library",
    "product": "os",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "os",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.25.12",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.26.0-0",
        "lessThan": "1.26.5",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.27.0-0",
        "lessThan": "1.27.0-rc.2",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "rootOpenFileNolog"
      },
      {
        "name": "openRootInRoot"
      },
      {
        "name": "OpenInRoot"
      },
      {
        "name": "Root.Create"
      },
      {
        "name": "Root.Open"
      },
      {
        "name": "Root.OpenFile"
      },
      {
        "name": "Root.OpenRoot"
      },
      {
        "name": "Root.ReadFile"
      },
      {
        "name": "Root.WriteFile"
      },
      {
        "name": "rootFS.Open"
      },
      {
        "name": "rootFS.ReadDir"
      },
      {
        "name": "rootFS.ReadFile"
      }
    ],
    "defaultStatus": "unaffected"
  }
]