StackRadar

CVE-2026-23949

High

Advisory

Published 13 Jan 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.6
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
247
of 17,781 indexed, latest versions
Container images
234
deployed by those charts
Fix available
4 of 5
affected packages

jaraco.context Has a Path Traversal Vulnerability

Carried by container images the latest versions of 247 of 17,781 indexed charts deploy, on 234 images.

Affected packageAffected versionsFixed inImages
jaraco-contextpypi5.3.0, 6.0.16.1.0230
setuptoolsdeb78.1.1-0.1no fix listed22
jaraco.contextdeb6.0.1-16.0.1-1+deb13u14
py3-setuptoolsapk75.8.0-r0, 80.9.0-r280.10.1-r02
python-3.11deb3.11.15+e43.11.16+e21
OSV records
CGA-4wp2-q477-v97pCGA-cf85-365m-jf68DEBIAN-CVE-2026-23949GHSA-58pv-8j8x-9vj2ECHO-4dea-2475-6d75
Also known as
CGA-5qxq-w4gg-f9m3, CGA-qcm3-5x5p-4pjj, PYSEC-2026-1469

Charts affected

247 by stars
ChartLatestAffected imagesRadar Score
rook-cephrookOfficialVerified publisher1.20.71 of 2See more

rook-ceph rook 1.20.7

1 of the 2 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
rook/ceph:v1.20.72f970c425617
jaraco-context@6.0.1
6.1.0

Open the chart page →

1,447
openebsopenebsOfficialVerified publisher4.6.11 of 35See more

openebs openebs 4.6.1

1 of the 35 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.30.2cdb361e67b1b
jaraco-context@5.3.0
6.1.0

Open the chart page →

23,894
dagsterdagsterVerified publisher1.13.222 of 5See more

dagster dagster 1.13.22

2 of the 5 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
dagster/dagster-celery-k8s:1.13.22e29a64392e12
jaraco-context@5.3.0
6.1.0
dagster/user-code-example:1.13.225947f9ae481c
jaraco-context@5.3.0
6.1.0

Open the chart page →

3,455
maildocker-postfixVerified publisher5.1.01 of 1See more

mail docker-postfix 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
boky/postfix:5.1.0aafc77238423
jaraco-context@6.0.1
jaraco.context@6.0.1-1
setuptools@78.1.1-0.1
6.1.0
6.0.1-1+deb13u1
no fix listed

Open the chart page →

5,366
ceph-csi-cephfsceph-csiOfficialVerified publisher3.17.11 of 6See more

ceph-csi-cephfs ceph-csi 3.17.1

1 of the 6 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.17.10b62db8afc9b
jaraco-context@6.0.1
6.1.0

Open the chart page →

4,061
ceph-csi-rbdceph-csiOfficialVerified publisher3.17.11 of 6See more

ceph-csi-rbd ceph-csi 3.17.1

1 of the 6 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.17.10b62db8afc9b
jaraco-context@6.0.1
6.1.0

Open the chart page →

4,061
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
jaraco-context@5.3.0
6.1.0

Open the chart page →

10,622
penpotpenpotOfficialVerified publisher1.9.01 of 4See more

penpot penpot 1.9.0

1 of the 4 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
penpotapp/backend:2.17.2770b55f6e51b
jaraco-context@6.0.1
6.1.0

Open the chart page →

4,314
pulsarapache4.7.01 of 10See more

pulsar apache 4.7.0

1 of the 10 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
jaraco-context@5.3.0
6.1.0

Open the chart page →

9,864
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
jaraco-context@5.3.0
6.1.0

Open the chart page →

16,251
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.3f09282d281f6
jaraco-context@5.3.0
6.1.0

Open the chart page →

11,384
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
jaraco-context@5.3.0
6.1.0

Open the chart page →

5,987
gotenbergmaikumoriVerified publisher1.25.01 of 1See more

gotenberg maikumori 1.25.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.36.087c16b9f3642
jaraco-context@5.3.0
setuptools@78.1.1-0.1
6.1.0
no fix listed

Open the chart page →

9,683
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
jaraco-context@5.3.0
py3-setuptools@75.8.0-r0
6.1.0
80.10.1-r0

Open the chart page →

17,245
cluster-secretclutersecretVerified publisher0.7.01 of 1See more

cluster-secret clutersecret 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
quay.io/clustersecret/clustersecret:0.0.14a9f835d1b241
jaraco-context@5.3.0
6.1.0

Open the chart page →

3,033
emqx-operatoremqx-operator2.3.21 of 2See more

emqx-operator emqx-operator 2.3.2

1 of the 2 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
alpine/k8s:1.31.49c4976d47656
jaraco-context@5.3.0
6.1.0

Open the chart page →

4,531
passboltpassbolt2.1.11 of 6See more

passbolt passbolt 2.1.1

1 of the 6 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
passbolt/passbolt:5.13.0-1-ceaf3a620902a0
jaraco-context@6.0.1
setuptools@78.1.1-0.1
6.1.0
no fix listed

Open the chart page →

13,350
abcdesktopabcdesktopOfficialVerified publisher4.4.121 of 9See more

abcdesktop abcdesktop 4.4.12

1 of the 9 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/abcdesktopio/route:4.449c972229c6b
jaraco-context@5.3.0
6.1.0

Open the chart page →

768
dagster-user-deploymentsdagsterVerified publisher1.13.221 of 1See more

dagster-user-deployments dagster 1.13.22

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
dagster/user-code-example:1.13.225947f9ae481c
jaraco-context@5.3.0
6.1.0

Open the chart page →

928
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
datamate/seafile-professional:11.0.202dd66b722464
jaraco-context@5.3.0
6.1.0

Open the chart page →

27,267
geonode-k8sgeonode-k8sVerified publisher2.0.01 of 10See more

geonode-k8s geonode-k8s 2.0.0

1 of the 10 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
geopython/pycsw:3.0.0-beta284662ea6b78b
jaraco-context@5.3.0
6.1.0

Open the chart page →

13,953
netscaler-ingress-controllernetscalerOfficialVerified publisher4.2.261 of 1See more

netscaler-ingress-controller netscaler 4.2.26

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
quay.io/netscaler/netscaler-k8s-ingress-controller:4.2.26a68453858339
jaraco-context@5.3.0
6.1.0

Open the chart page →

142
changedetectionalekcVerified publisher0.14.21 of 1See more

changedetection alekc 0.14.2

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.47bb6963b730d
jaraco-context@5.3.0
6.1.0

Open the chart page →

2,595
alerta-webalerta-webVerified publisher0.1.121 of 2See more

alerta-web alerta-web 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
hayk96/alerta-web:9.0.486377705e9e3
jaraco-context@5.3.0
6.1.0

Open the chart page →

3,569
kiali-operatorkiali2.31.01 of 1See more

kiali-operator kiali 2.31.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
quay.io/kiali/kiali-operator:v2.31.0f837d8f25545
jaraco-context@5.3.0
6.1.0

Open the chart page →

1,157
bitwarden-crd-operatorlerentisVerified publisher0.18.01 of 1See more

bitwarden-crd-operator lerentis 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/lerentis/bitwarden-crd-operator:0.17.00a608c6ead85
jaraco-context@5.3.0
6.1.0

Open the chart page →

2,003
kubecostmesosphere-stable0.37.51 of 9See more

kubecost mesosphere-stable 0.37.5

1 of the 9 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.28.04166a019eeaf
jaraco-context@5.3.0
6.1.0

Open the chart page →

17,693
netscaler-cpx-with-ingress-controllernetscalerOfficialVerified publisher4.1.171 of 2See more

netscaler-cpx-with-ingress-controller netscaler 4.1.17

1 of the 2 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
quay.io/netscaler/netscaler-k8s-ingress-controller:4.1.1755b12c2a8440
jaraco-context@5.3.0
6.1.0

Open the chart page →

394
plecopleco0.24.01 of 1See more

pleco pleco 0.24.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
public.ecr.aws/r3m4q3r9/pleco:0.24.0651739583336
jaraco-context@5.3.0
6.1.0

Open the chart page →

1,346
plausiblesinextraVerified publisher1.1.21 of 1See more

plausible sinextra 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/plausible/community-edition:v3.2.133e60bfb40f2
jaraco-context@5.3.0
6.1.0

Open the chart page →

859
skypilotskypilotOfficialVerified publisher0.13.01 of 3See more

skypilot skypilot 0.13.0

1 of the 3 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot:0.13.03bc8bf8f4d83
jaraco-context@5.3.0
6.1.0

Open the chart page →

5,852
pretixtechwolf12Verified publisher2026.7.01 of 3See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
pretix/standalone:2026.7.05df3b7aa852e
jaraco-context@6.0.1
setuptools@78.1.1-0.1
6.1.0
no fix listed

Open the chart page →

9,770
paperless-ngxadnoctemVerified publisher0.4.21 of 5See more

paperless-ngx adnoctem 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.36.087c16b9f3642
jaraco-context@5.3.0
setuptools@78.1.1-0.1
6.1.0
no fix listed

Open the chart page →

19,691
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
setuptools@78.1.1-0.1
no fix listed

Open the chart page →

5,880
upcloud-csiankra-chartsVerified publisher0.4.01 of 8See more

upcloud-csi ankra-charts 0.4.0

1 of the 8 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
alpine/k8s:1.31.137a319b15cfc9
jaraco-context@5.3.0
6.1.0

Open the chart page →

14,917
tikaapache-tika3.2.21 of 1See more

tika apache-tika 3.2.2

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
apache/tika:3.2.2.0-fullffab324253ed
jaraco-context@6.0.1
6.1.0

Open the chart page →

437
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
jaraco-context@5.3.0
6.1.0

Open the chart page →

11,205
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
jaraco-context@5.3.0
6.1.0

Open the chart page →

13,761
kubedashdevopstalesOfficialVerified publisher4.0.01 of 8See more

kubedash devopstales 4.0.0

1 of the 8 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
devopstales/kubedash:3.1.08bb837da5aec
jaraco-context@5.3.0
6.1.0

Open the chart page →

9,205
seafiledr300481Verified publisher0.12.11 of 1See more

seafile dr300481 0.12.1

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:11.0.12d0c66e4621bd
jaraco-context@5.3.0
6.1.0

Open the chart page →

10,858
vulnz-nvd-mirroreugen1.0.01 of 1See more

vulnz-nvd-mirror eugen 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/jeremylong/open-vulnerability-data-mirror:v9.0.49a69aa14dc3e
jaraco-context@5.3.0
6.1.0

Open the chart page →

1,675
taigafermosit0.0.112 of 7See more

taiga fermosit 0.0.11

2 of the 7 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
taigaio/taiga-back:latest4beed8f62c9f
jaraco-context@5.3.0
6.1.0
taigaio/taiga-protected:latestfd4568a97a59
jaraco-context@5.3.0
6.1.0

Open the chart page →

8,496
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latesta5c1daef46c0
jaraco-context@5.3.0
6.1.0

Open the chart page →

1,965
valheimgeek-cookbookVerified publisher4.4.21 of 1See more

valheim geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/lloesche/valheim-server:latest20fde516ce31
jaraco-context@6.0.1
setuptools@78.1.1-0.1
6.1.0
no fix listed

Open the chart page →

4,879
geo-checkergeo-checkerVerified publisher5.0.01 of 1See more

geo-checker geo-checker 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ymuski/geo-checker:5.0.05ba7fd8c7bdc
jaraco-context@5.3.0
6.1.0

Open the chart page →

1,455
helmuphelmupVerified publisher0.1.01 of 3See more

helmup helmup 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
jaraco-context@5.3.0
6.1.0

Open the chart page →

16,514
hpe-greenlake-file-csi-driverhpe-storageVerified publisher2.6.41 of 7See more

hpe-greenlake-file-csi-driver hpe-storage 2.6.4

1 of the 7 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
quay.io/hpestorage/filex-csi-driver:2.6.4b7f960bbf472
jaraco-context@5.3.0
6.1.0

Open the chart page →

6,095
huehue1.0.31 of 3See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
gethue/hue:latest7d5c1b9f8a79
jaraco-context@5.3.0
6.1.0

Open the chart page →

12,397
iris-webappiris-webapp0.2.41 of 2See more

iris-webapp iris-webapp 0.2.4

1 of the 2 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
jaraco-context@5.3.0
6.1.0

Open the chart page →

11,764
jenkinsjkimVerified publisher5.5.141 of 2See more

jenkins jkim 5.5.14

1 of the 2 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.27.6db85bd553253
jaraco-context@5.3.0
6.1.0

Open the chart page →

7,387

Container images carrying it

234 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
jaraco-context@5.3.0
6.1.0
1
ghcr.io/sdr-enthusiasts/docker-flightradar24:latest917e53402d51
jaraco-context@6.0.1
setuptools@78.1.1-0.1
6.1.0
no fix listed
1
ghcr.io/seanmorley15/adventurelog-backend:v0.13.00250d9cb0d74
jaraco-context@6.0.1
setuptools@78.1.1-0.1
6.1.0
no fix listed
1
ghcr.io/serenita-org/vero:v0.8.3e5a7ec714acc
jaraco-context@5.3.0
6.1.0
1
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
jaraco-context@6.0.1
6.1.0
1
ghcr.io/substra/substra-backend:1.0.121967f54ec86
jaraco-context@5.3.0
6.1.0
1
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
jaraco-context@5.3.0
6.1.0
1
ghcr.io/texano00/urunner:0.6.07c8be1dae3cd
jaraco-context@5.3.0
6.1.0
1
ghcr.io/timothepoznanski/poznote:6.80.0045035db3a20
jaraco-context@5.3.0
6.1.0
1
ghcr.io/virtuos/librechat_exporter:2.0.050ea1cf0086f
jaraco-context@5.3.0
6.1.0
1
ghcr.io/yahoon/helm-demo:1.0.02930290a758c
jaraco-context@5.3.0
6.1.0
1
ghcr.io/zazukoians/qlever-ui:v0.10.034c7b540a095
jaraco-context@5.3.0
6.1.0
1
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
jaraco-context@5.3.0
6.1.0
1
public.ecr.aws/aktosecurity/akto-ai-automated-testing:latest5a5d32281374
jaraco-context@5.3.0
6.1.0
1
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
jaraco-context@5.3.0
6.1.0
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
jaraco-context@5.3.0
6.1.0
1
public.ecr.aws/r3m4q3r9/pleco:0.24.0651739583336
jaraco-context@5.3.0
6.1.0
1
quay.io/ceph/ceph:v21.1.05ff3692d2f3f
jaraco-context@6.0.1
6.1.0
1
quay.io/clustersecret/clustersecret:0.0.14a9f835d1b241
jaraco-context@5.3.0
6.1.0
1
quay.io/hpestorage/filex-csi-driver:2.6.4b7f960bbf472
jaraco-context@5.3.0
6.1.0
1
quay.io/kiali/kiali-operator:v2.31.0f837d8f25545
jaraco-context@5.3.0
6.1.0
1
quay.io/kiwigrid/k8s-sidecar:1.30.349dcce269568
jaraco-context@5.3.0
6.1.0
1
quay.io/kiwigrid/k8s-sidecar:1.30.10835d79d8fbae
jaraco-context@5.3.0
6.1.0
1
quay.io/netscaler/netscaler-k8s-ingress-controller:4.1.1755b12c2a8440
jaraco-context@5.3.0
6.1.0
1
quay.io/netscaler/netscaler-k8s-ingress-controller:4.2.26a68453858339
jaraco-context@5.3.0
6.1.0
1
quay.io/ocellusai/operator:v0.10.59ff01f642e2b
jaraco-context@5.3.0
6.1.0
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
jaraco-context@6.0.1
6.1.0
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
jaraco-context@6.0.1
6.1.0
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
jaraco-context@6.0.1
6.1.0
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
jaraco-context@6.0.1
6.1.0
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
jaraco-context@6.0.1
6.1.0
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
jaraco-context@6.0.1
6.1.0
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
jaraco-context@6.0.1
6.1.0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
jaraco-context@5.3.0
6.1.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.