GHSA-qw64-3x98-g7q2

Suggest an improvement
Source
https://github.com/advisories/GHSA-qw64-3x98-g7q2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-qw64-3x98-g7q2/GHSA-qw64-3x98-g7q2.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qw64-3x98-g7q2
Aliases
  • CVE-2026-44973
Downstream
Related
Published
2026-05-14T18:25:38Z
Modified
2026-06-09T10:30:12.800615329Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
go-billy has path traversal vulnerabilities
Details

Impact

Multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories.

While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on go-billy for some level of isolation may inadvertently expose access to unintended filesystem locations.

The osfs.ChrootOS implementation is notably affected by this vulnerability and is now deprecated in v5, removed at v6. Users are recommended to move on to osfs.BoundOS instead: osfs.New(path, WithBoundOS()).

Users requiring stronger security boundary enforcement are recommended to upgrade to v6, where the osfs implementation are backed by the traversal-resistant primitive os.Root.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.

Credits

Thanks to @faran66 and @vnykmshr for finding and separately reporting this issue privately to the go-git project. 🙇

Database specific 
{
    "github_reviewed": true,
    "severity": "HIGH",
    "nvd_published_at": "2026-05-28T22:16:59Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "github_reviewed_at": "2026-05-14T18:25:38Z"
}
References

Affected packages

Go / github.com/go-git/go-billy/v5

Package

Name
github.com/go-git/go-billy/v5
View open source insights on deps.dev
Purl
pkg:golang/github.com/go-git/go-billy/v5

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.9.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-qw64-3x98-g7q2/GHSA-qw64-3x98-g7q2.json"

Go / github.com/go-git/go-billy/v6

Package

Name
github.com/go-git/go-billy/v6
View open source insights on deps.dev
Purl
pkg:golang/github.com/go-git/go-billy/v6

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.0-alpha.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-qw64-3x98-g7q2/GHSA-qw64-3x98-g7q2.json"