CVE-2026-44973

Name of the Vulnerable Software and Affected Versions go-billy versions prior to 5.9.0

Description Multiple path traversal issues exist across different components of the software due to insufficient path sanitization and boundary enforcement. This allows crafted paths, such as those using .., to escape intended base directories. Consequently, applications relying on the software for isolation may inadvertently expose access to unintended filesystem locations. The osfs.ChrootOS implementation is notably affected.

Recommendations Update to version 5.9.0 or later. As a temporary mitigation, replace the osfs.ChrootOS implementation with osfs.BoundOS using osfs.New(path, WithBoundOS()). For stronger security boundary enforcement, upgrade to version 6, where osfs implementations are backed by the os.Root primitive.