CVE-2026-44973: go-billy Path Traversal Vulnerabilities
Summary
CVE-2026-44973: go-billy has path traversal vulnerabilities. Affects github.com/go-git/go-billy/v5 versions < 5.9.0. Fixed in 5.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
go-billy is a Go library that provides an abstraction for file system operations, allowing developers to work with various file system backends seamlessly. It is designed to facilitate file handling in applications, but it has been found to have multiple path traversal vulnerabilities due to insufficient path sanitization. This can lead to unintended access to filesystem locations, compromising application security.
Vulnerability Detail
The vulnerability arises from multiple path traversal issues within the go-billy library. Insufficient path sanitization and boundary enforcement can allow crafted paths, such as those using '..', to escape intended base directories. This is particularly concerning for applications that rely on go-billy for isolation, as it may inadvertently expose sensitive filesystem locations. The osfs.ChrootOS implementation is notably affected and has been deprecated in version 5, with removal in version 6. Users are encouraged to migrate to the osfs.BoundOS implementation for better security.
How To Fix
Latest published version: v5.9.2 as of 22 Oct 2026
go get github.com/go-git/go-billy/v5@v5.9.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.9.0
This is the first release that contains the fix.
go get github.com/go-git/go-billy/v5@v5.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can switch to using the osfs.BoundOS implementation instead of the deprecated osfs.ChrootOS. This can be done by initializing the file system with the following code:
import (
"github.com/go-git/go-billy/v5/osfs"
)
fs := osfs.New(path, osfs.WithBoundOS())
Conclusion
In summary, the go-billy library has been found to have significant path traversal vulnerabilities that can lead to unauthorized filesystem access. Users are strongly advised to upgrade to the latest patched versions and consider using safer implementations to enhance security.
See every vulnerability recorded for github.com/go-git/go-billy/v5 →
FAQ
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
Versions prior to v5.9.0 and v6.0.0-alpha.1 are likely to be affected by this vulnerability.
If immediate upgrading is not possible, consider using the osfs.BoundOS implementation as a temporary workaround.
You can use Vulert's playground to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just the Gopkg.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/go-git/go-billy/v5.
