Is CVE-2026-44973 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44973 being exploited in the wild.

How severe is CVE-2026-44973?

High severity, with a CVSS score of 8.1, published 28 May 2026.

Which products and versions are affected?

github.com/go-git/go-billy/v5 (Go) < 5.9.0, SEMVER:introduced=0,fixed=5.9.0; github.com/go-git/go-billy/v6 (Go) < 6.0.0-alpha.1, SEMVER:introduced=0,fixed=6.0.0-alpha.1; Go-Git Go-Billy < 5.9.0, < v5.9.0.

Is there a fix for CVE-2026-44973?

Yes. github.com/go-git/go-billy/v5 (Go): upgrade to 5.9.0 or later; github.com/go-git/go-billy/v6 (Go): upgrade to 6.0.0-alpha.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44973 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44973?

Check whether you run github.com/go-git/go-billy/v5 (Go), github.com/go-git/go-billy/v6 (Go) or Go-Git Go-Billy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44973: go-git go-billy path traversal in multiple components

Q: Is there a fix for CVE-2026-44973?

Yes. github.com/go-git/go-billy/v5 (Go): upgrade to 5.9.0 or later; github.com/go-git/go-billy/v6 (Go): upgrade to 6.0.0-alpha.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44973 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44973?

Check whether you run github.com/go-git/go-billy/v5 (Go), github.com/go-git/go-billy/v6 (Go) or Go-Git Go-Billy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44973 · Severity: high · CVSS 8.1 · Published 2026-05-28

go-billy is a file system abstraction library used by Go applications to manage files. A vulnerability in its path handling allows attackers to use special characters to access files outside of the intended directory. This could lead to unauthorized access to sensitive system files or the modification of critical data.

Vendors: Go, Go-Git.

Quick answers

Is CVE-2026-44973 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44973 being exploited in the wild.
How severe is CVE-2026-44973?: High severity, with a CVSS score of 8.1, published 28 May 2026.
Which products and versions are affected?: github.com/go-git/go-billy/v5 (Go) < 5.9.0, SEMVER:introduced=0,fixed=5.9.0; github.com/go-git/go-billy/v6 (Go) < 6.0.0-alpha.1, SEMVER:introduced=0,fixed=6.0.0-alpha.1; Go-Git Go-Billy < 5.9.0, < v5.9.0.
Is there a fix for CVE-2026-44973?: Yes. github.com/go-git/go-billy/v5 (Go): upgrade to 5.9.0 or later; github.com/go-git/go-billy/v6 (Go): upgrade to 6.0.0-alpha.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44973 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44973?: Check whether you run github.com/go-git/go-billy/v5 (Go), github.com/go-git/go-billy/v6 (Go) or Go-Git Go-Billy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/go-git/go-billy/v5 (Go): upgrade to 5.9.0 or later
```
go get github.com/go-git/go-billy/v5@v5.9.0
```
github.com/go-git/go-billy/v6 (Go): upgrade to 6.0.0-alpha.1 or later
```
go get github.com/go-git/go-billy/v6@v6.0.0-alpha.1
```

Technical details

Multiple path traversal vulnerabilities (CWE-22) exist in go-billy due to insufficient path sanitization and boundary enforcement. The osfs.ChrootOS implementation is specifically noted as vulnerable, failing to prevent '..' sequences from escaping the chroot environment. An attacker with the ability to provide file paths to an application using go-billy can read or write files outside the restricted base directory. The issue is addressed in v5.9.0 by deprecating ChrootOS in favor of BoundOS, and in v6 by utilizing the traversal-resistant os.Root primitive.

Affected products

go-git go-billy/v5 < 5.9.0
go-git go-billy/v6 < 6.0.0-alpha.1

Identifiers

CVE-2026-44973
GHSA-qw64-3x98-g7q2
GO-2026-5597

Timeline

2026-05-11: disclosed: Initial disclosure in go-git/go-billy repository
2026-05-14: advisory: GitHub Advisory published
2026-05-28: other: NVD published date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.