PT-2026-41151 · Go-Billy · Go-Billy

Published 2026-05-14 · Updated 2026-05-28 · CVE-2026-44973

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions go-billy versions prior to 5.9.0

Description Multiple path traversal issues exist across different components of the software due to insufficient path sanitization and boundary enforcement. This allows crafted paths, such as those using .., to escape intended base directories. Consequently, applications relying on the software for isolation may inadvertently expose access to unintended filesystem locations. The osfs.ChrootOS implementation is notably affected.

Recommendations Update to version 5.9.0 or later. As a temporary mitigation, replace the osfs.ChrootOS implementation with osfs.BoundOS using osfs.New(path, WithBoundOS()). For stronger security boundary enforcement, upgrade to version 6, where osfs implementations are backed by the os.Root primitive.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CLEANSTART-2026-UY49411

CVE-2026-44973

GHSA-QW64-3X98-G7Q2

Affected Products

Go-Billy

References · 56

• https://cve.org/CVERecord?id=CVE-2026-44973 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39820 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39836 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44973 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-44973 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44740 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33812 · Security Note
• https://ubuntu.com/security/CVE-2026-44973 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39825 · Security Note
• https://osv.dev/vulnerability/GHSA-qw64-3x98-g7q2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-44973 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39819 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42501 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-UY49411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32952 · Security Note