CVE-2026-44973
Billy: Path traversal vulnerabilities
Billy is an interface filesystem abstraction for Go. Prior to 5.9.0, multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories. While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on go-billy for some level of isolation may inadvertently expose access to unintended filesystem locations. This vulnerability is fixed in 5.9.0.
| CWE | CWE-22 |
| Vendor | go-git |
| Product | go-billy |
| Published | May 28, 2026 |
| Last Updated | Jun 1, 2026 |
Get instant alerts for go-git go-billy
Be the first to know when new high vulnerabilities affecting go-git go-billy are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N