CVE-2026-44973: go-git go-billy path traversal in multiple components

Executive brief

go-billy is a file system abstraction library used by Go applications to manage files. A vulnerability in its path handling allows attackers to use special characters to access files outside of the intended directory. This could lead to unauthorized access to sensitive system files or the modification of critical data.

Technical details

Multiple path traversal vulnerabilities (CWE-22) exist in go-billy due to insufficient path sanitization and boundary enforcement. The osfs.ChrootOS implementation is specifically noted as vulnerable, failing to prevent '..' sequences from escaping the chroot environment. An attacker with the ability to provide file paths to an application using go-billy can read or write files outside the restricted base directory. The issue is addressed in v5.9.0 by deprecating ChrootOS in favor of BoundOS, and in v6 by utilizing the traversal-resistant os.Root primitive.

Affected products

• go-git go-billy/v5 < 5.9.0
• go-git go-billy/v6 < 6.0.0-alpha.1

Timeline

• 2026-05-11: disclosed: Initial disclosure in go-git/go-billy repository
• 2026-05-14: advisory: GitHub Advisory published
• 2026-05-28: other: NVD published date

References

• https://api.github.com/users/faran66
• https://github.com/faran66
• https://api.github.com/users/faran66/gists%7B/gist_id%7D
• https://api.github.com/users/faran66/repos
• https://avatars.githubusercontent.com/u/71405717?v=4
• https://api.github.com/users/faran66/events%7B/privacy%7D