CVE-2026-56857
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
Risk Assessment
An attacker could exploit this vulnerability to create directories outside the allowed area, potentially leading to unauthorized data access or privilege escalation.
Recommendation
Update the software to a version that includes a fix for this vulnerability. Additionally, restrict the use of Root.Mkdir and Root.MkdirAll on paths containing junctions.
Other vulnerabilities in Root
Original NVD description (English source)
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS