CVE-2026-44973
Path Traversal in Go Billy Filesystem Abstraction
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in go-billy, an interface filesystem abstraction for the Go programming language. Prior to version 5.9.0, multiple path traversal issues were present across different components of go-billy. Due to insufficient path sanitization and boundary enforcement, specially crafted paths using sequences like ".." could escape the intended base directories. Although go-billy was not originally designed to provide a strong security boundary, these inconsistencies in some built-in implementations could allow applications relying on go-billy for isolation to inadvertently expose access to unintended filesystem locations.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to perform path traversal attacks, potentially accessing files and directories outside the intended scope of the application. This can lead to unauthorized disclosure of sensitive information or exposure of critical filesystem locations. Since the vulnerability allows crafted paths to escape base directories, applications relying on go-billy for isolation may inadvertently expose unintended filesystem locations, increasing the risk of data breaches or information leakage.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade the go-billy library to version 5.9.0 or later, where the path traversal issues have been fixed.
Additionally, review any applications relying on go-billy for filesystem isolation to ensure they do not depend on it as a strong security boundary.