CVE-2026-44973: Billy: Path traversal vulnerabilities

Synopsis

Path traversal vulnerabilities affect go-billy, a filesystem abstraction library for Go used in applications that rely on it for directory isolation. The vulnerabilities are reachable over the network by any authenticated user with a low-privilege account, and require no victim interaction. Successful exploitation allows an attacker to read files and write files outside the intended base directory, escaping the filesystem boundary the application assumes is in place. HarborGuard tracks this CVE and will make a patched-image rebuild available at version 5.9.0 the moment a fixed upstream release is confirmed as resolvable in affected images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; the attacker sends crafted path requests remotely.

• AuthenticationRequired

  A valid account is required, but any low-privilege account is sufficient to attempt path traversal.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker interacts directly with the service.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors are required.

Blast Radius

• Reads files from arbitrary filesystem locations outside the intended base directory, including application secrets, configuration files, and credentials stored on the host.
• Writes or overwrites files at arbitrary filesystem paths, allowing modification of application data, configuration, or code accessible to the process.
• Applications that rely on go-billy for directory isolation lose that boundary entirely, widening the exposure to any path the process user can access.