CVE-2026-44973: Billy: Path traversal vulnerabilities
Impact Multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories.
While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on go-billy for some level of isolation may inadvertently expose access to unintended filesystem locations.
The osfs.ChrootOS implementation is notably affected by this vulnerability and is now deprecated in v5, removed at v6. Users are recommended to move on to osfs.BoundOS instead: osfs.New(path, WithBoundOS()).
Users requiring stronger security boundary enforcement are recommended to upgrade to v6, where the osfs implementation are backed by the traversal-resistant primitive os.Root.
Patches Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.
Credits Thanks to @faran66 and @vnykmshr for finding and separately reporting this issue privately to the go-git project. 🙇
Other sources
Billy is an interface filesystem abstraction for Go. Prior to 5.9.0, multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories. While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on go-billy for some level of isolation may inadvertently expose access to unintended filesystem locations. This vulnerability is fixed in 5.9.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/go-git/go-billy/v6to a version that resolves this vulnerability.Fixed in 6.0.0-alpha.1 - Upgrade
Upgrade
go/github.com/go-git/go-billy/v5to a version that resolves this vulnerability.Fixed in 5.9.0 - Upgrade
Upgrade
go-billyto a version that resolves this vulnerability.Fixed in 5.9.0 - Upgrade
Upgrade
go-billyto a version that resolves this vulnerability.Fixed in v6 - Configuration
Move from the deprecated osfs.ChrootOS to osfs.BoundOS by using `osfs.New(path, WithBoundOS())`.
go-billy osfs.New (WithBoundOS) WithBoundOS() = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44973?
CVE-2026-44973 is classified as having multiple path traversal issues that can lead to the escape of intended base directories.
How do I fix CVE-2026-44973?
To fix CVE-2026-44973, upgrade to version 5.9.0 or higher for go-git/go-billy/v5 and 6.0.0-alpha.1 or higher for go-git/go-billy/v6.
What components are affected by CVE-2026-44973?
CVE-2026-44973 affects different components within the go-git/go-billy library.
What can happen if CVE-2026-44973 is exploited?
Exploitation of CVE-2026-44973 may allow attackers to manipulate file paths and gain unauthorized access to sensitive directories.
Is there a known workaround for CVE-2026-44973?
There are no known workarounds for CVE-2026-44973 other than applying the recommended version updates.