CVE-2026-44973High· 8.1▾ TwilightA flaw was found in go-billy, an interface filesystem abstraction for Go. Multiple path traversal vulnerabilities exist due to insufficient path sanitization and boundary enforcement. A remote attacker could exploit this by crafting malici…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
Last analysed / modified upstream
0.3% → 0.5%
A flaw was found in go-billy, an interface filesystem abstraction for Go. Multiple path traversal vulnerabilities exist due to insufficient path sanitization and boundary enforcement. A remote attacker could exploit this by crafting malicious paths, allowing them to escape intended base directories. This could lead to unauthorized access to sensitive filesystem locations, potentially resulting in information disclosure or modification of files.
github.com/go-git/go-billy: Go-billy: Arbitrary file access due to path traversal vulnerability — rated Important by Red Hat. Released 2026-05-28, updated 2026-09-14.
Affected:
No fix planned:
Will not fix
Affected packages:
github.com/go-git/go-billy/v5 < 5.9.0github.com/go-git/go-billy/v6 < 6.0.0-alpha.1Patched in:
github.com/go-git/go-billy/v5 5.9.0github.com/go-git/go-billy/v6 6.0.0-alpha.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-35206Medium· 4.4github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (CVE-2026-35206)
CVE-2020-27534Medium· 5.3moby/buildkit: calls os.OpenFile with a potentially unsafe qemu-check temporary pathname (CVE-2020-27534)
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)
CVE-2025-59940Medium· 6.5mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin
CVE-2026-55888High· 8.2xdg-desktop-portal: xdg-desktop-portal: Unauthorized host file access via unvalidated FileChooser filenames (CVE-2026-55888)
CVE-2026-115354Medium· 6.5mistune: mistune: Information disclosure via path traversal in Include directive (CVE-2026-115354)