CVE catalog

CVE-2026-44973

Billy is an interface filesystem abstraction for Go. Prior to 5.9.0, multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforceme

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.31% · Oct 25, 2026

Billy is an interface filesystem abstraction for Go. Prior to 5.9.0, multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories. While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on go-billy for some level of isolation may inadvertently expose access to unintended filesystem locations. This vulnerability is fixed in 5.9.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-go-git-go-billysid5.9.1-1fixed
Debiangolang-github-go-git-go-billyforky5.9.1-1fixed
Debiangolang-github-go-git-go-billytrixie5.5.0-1vulnerable
Debiangolang-github-go-git-go-billybookworm5.3.1-3vulnerable
Cpegolang-github-go-git-go-billyNot reportedNot reportedvulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-go-git-go-billysourcesid5.9.0-1not yet assignedNot reportedNot reported
Debiangolang-github-go-git-go-billysourceforky5.9.0-1not yet assignedNot reportedNot reported
Debiangolang-github-go-git-go-billysourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiangolang-github-go-git-go-billysourcebookworm(unfixed)not yet assignedNot reportedNot reported

Notes

[trixie] golang-github-go-git-go-billy: Minor issue [bookworm] golang-github-go-git-go-billy: Limited support, minor issue; path traversal

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-go-git-go-billy-dev]Affected

    Source package: [golang-github-go-git-go-billy]

    Details (2)

    • 5.3.1-3 · all · bookworm

      Affected

      nvd · golang-github-go-git-go-billy · debian · bookworm; nvd · golang-github-go-git-go-billy · debian · 12

    • 5.3.1-3 · all · bookworm

      Affected

      nvd · golang-github-go-git-go-billy · debian · bookworm; nvd · golang-github-go-git-go-billy · debian · 12

[Debian 13 (Trixie)]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]