CVE-2026-44973 Details
Description
Billy is an interface filesystem abstraction for Go. Prior to 5.9.0, multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories. While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on go-billy for some level of isolation may inadvertently expose access to unintended filesystem locations. This vulnerability is fixed in 5.9.0.
A path traversal vulnerability has been identified in go-billy, a filesystem abstraction library for Go, affecting versions prior to 5.9.0. The vulnerability arises from inadequate path sanitization and boundary enforcement, which may allow crafted paths to escape designated base directories. While go-billy was not initially intended to enforce strict security boundaries, some built-in implementations exhibited inconsistent behavior. This could lead to applications using go-billy for isolation inadvertently exposing access to unintended filesystem areas. The vulnerability is particularly relevant for the 'osfs.ChrootOS' implementation, which has been deprecated in version 5 and removed in version 6.0.0-alpha.1.
Users are advised to upgrade to go-billy version 5.9.0 or version 6.0.0-alpha.1. For those using the 'osfs.ChrootOS' implementation, it is recommended to switch to 'osfs.BoundOS' instead. Users requiring stronger security boundary enforcement should upgrade to version 6, where the 'osfs' implementations are supported by traversal-resistant primitives.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed Jun 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-git/go-billy/security/advisories/GHSA-qw64-3x98-g7q2 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| go-billy | < v5.9.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |