Path Traversal Vulnerabilities in Billy Filesystem Abstraction for Go

CVE-2026-44973

What is CVE-2026-44973?

Billy, a filesystem abstraction for the Go programming language, has multiple path traversal vulnerabilities prior to version 5.9.0. These vulnerabilities are a result of insufficient path sanitization and boundary enforcement, allowing malicious users to escape intended base directories through crafted paths (e.g., using '..'). Although Billy was not designed for strong security boundaries, the inconsistent enforcement of these boundaries across different built-in implementations can lead to unintended filesystem access. Applications utilizing go-billy for isolation may inadvertently expose sensitive data or allow unauthorized access. The identified vulnerabilities have been addressed in version 5.9.0, reinforcing the need for developers to update their implementations to ensure robust security practices.

References