Go Command 'Pack' Subcommand Path Traversal Vulnerability

A path traversal vulnerability has been identified in the 'go tool pack' subcommand, which is typically used internally by the Go compiler. This vulnerability arises because the 'pack' subcommand does not properly sanitize output filenames. As a result, extracting a malicious archive can lead to files being written to arbitrary locations on the filesystem. This issue affects Go versions prior to 1.25.10 and from 1.26.0 up to but not including 1.26.3.

Impact

Exploitation of this vulnerability allows for arbitrary file writing on the filesystem, which could potentially overwrite existing files or create new ones in sensitive locations.

Remediation

Users can upgrade to Go versions 1.26.3 or 1.25.10, both of which include the necessary fix. Instructions for downloading these versions are available on the Go website.