On Windows, when the target of Root.Mkdir or Root.MkdirAll was a junction pointing to an empty location, the operation would create a directory at the junction target even when that target was located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

Root.Mkdir and Root.MkdirAll now correctly avoid resolving junctions.

NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81739