StackRadar

CVE-2026-23949

High

Advisory

Published 13 Jan 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.6
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
247
of 17,781 indexed, latest versions
Container images
234
deployed by those charts
Fix available
4 of 5
affected packages

jaraco.context Has a Path Traversal Vulnerability

Carried by container images the latest versions of 247 of 17,781 indexed charts deploy, on 234 images.

Affected packageAffected versionsFixed inImages
jaraco-contextpypi5.3.0, 6.0.16.1.0230
setuptoolsdeb78.1.1-0.1no fix listed22
jaraco.contextdeb6.0.1-16.0.1-1+deb13u14
py3-setuptoolsapk75.8.0-r0, 80.9.0-r280.10.1-r02
python-3.11deb3.11.15+e43.11.16+e21
OSV records
CGA-4wp2-q477-v97pCGA-cf85-365m-jf68DEBIAN-CVE-2026-23949GHSA-58pv-8j8x-9vj2ECHO-4dea-2475-6d75
Also known as
CGA-5qxq-w4gg-f9m3, CGA-qcm3-5x5p-4pjj, PYSEC-2026-1469

Charts affected

247 by stars
ChartLatestAffected imagesRadar Score
ctfdpascaliskeVerified publisher2.0.01 of 1See more

ctfd pascaliske 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/ctfd/ctfd:3.8.2870e396fddf8
jaraco-context@5.3.0
6.1.0

Open the chart page →

2,376
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
jaraco-context@5.3.0
6.1.0

Open the chart page →

4,749
stk-fluent-bit-loki-s3paxtecnologia0.2.01 of 6See more

stk-fluent-bit-loki-s3 paxtecnologia 0.2.0

1 of the 6 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
jaraco-context@5.3.0
6.1.0

Open the chart page →

3,739
falcon-asgi-serverphanVerified publisher0.1.01 of 1See more

falcon-asgi-server phan 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
phan2410/falcon-asgi-server:0.1.04a86d138832d
jaraco-context@5.3.0
6.1.0

Open the chart page →

8,189
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
knspar/phronetis:0.1.4609499d2dc91a
jaraco-context@6.0.1
6.1.0

Open the chart page →

16,196
pingdom-operatorpingdom-operator0.0.201 of 1See more

pingdom-operator pingdom-operator 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/nefelim4ag/pingdom-operator:0.0.15f8c7afdcf439
jaraco-context@5.3.0
6.1.0

Open the chart page →

11,923
port-agentport-labsVerified publisher0.8.161 of 1See more

port-agent port-labs 0.8.16

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/port-labs/port-agent:v0.8.12c92d1e223f5c
jaraco-context@5.3.0
python-3.11@3.11.15+e4
6.1.0
3.11.16+e2

Open the chart page →

727
prismeai-appsprismeai0.7.11 of 4See more

prismeai-apps prismeai 0.7.1

1 of the 4 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
jaraco-context@5.3.0
6.1.0

Open the chart page →

2,751
prismeai-coreprismeai1.12.11 of 7See more

prismeai-core prismeai 1.12.1

1 of the 7 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
jaraco-context@5.3.0
6.1.0

Open the chart page →

3,270
qubivaqubiva0.3.21 of 3See more

qubiva qubiva 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
jaraco-context@5.3.0
6.1.0

Open the chart page →

4,272
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
jaraco-context@5.3.0
6.1.0

Open the chart page →

21,211
kubecostradar-baseVerified publisher1.0.02 of 7See more

kubecost radar-base 1.0.0

2 of the 7 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
gcr.io/kubecost1/kubecost-modeling:v0.1.22a461dc5cb96a
jaraco-context@6.0.1
6.1.0
ghcr.io/kiwigrid/k8s-sidecar:1.29.142002d66ddb3
jaraco-context@5.3.0
6.1.0

Open the chart page →

9,355
juicepassproxyretsamedocVerified publisher2026.2.41 of 1See more

juicepassproxy retsamedoc 2026.2.4

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/juicerescue/juicepassproxy:0.5.1984dc4f19162
jaraco-context@5.3.0
6.1.0

Open the chart page →

3,938
revwallet-apirevwallet0.7.121 of 1See more

revwallet-api revwallet 0.7.12

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
arthurjguerra18/revwallet:v0.7.12f540af20b307
jaraco-context@5.3.0
6.1.0

Open the chart page →

5,790
kresusrm3lVerified publisher0.2.11 of 3See more

kresus rm3l 0.2.1

1 of the 3 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
bnjbvr/kresus:0.22.137e216b182c8
jaraco-context@5.3.0
6.1.0

Open the chart page →

15,591
matrix-stackrock8sVerified publisher0.8.11 of 7See more

matrix-stack rock8s 0.8.1

1 of the 7 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
jaraco-context@5.3.0
6.1.0

Open the chart page →

9,256
monitoringrocketchat-server0.0.171 of 9See more

monitoring rocketchat-server 0.0.17

1 of the 9 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.30.98c06e1ba643a
jaraco-context@5.3.0
6.1.0

Open the chart page →

6,859
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
jaraco-context@5.3.0
6.1.0

Open the chart page →

9,607
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
jaraco-context@6.0.1
6.1.0

Open the chart page →

3,512
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
jaraco-context@6.0.1
6.1.0

Open the chart page →

4,718
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
jaraco-context@5.3.0
6.1.0

Open the chart page →

7,436
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
jaraco-context@5.3.0
6.1.0

Open the chart page →

4,499
flaresolverrrubxkubeVerified publisher0.1.11 of 1See more

flaresolverr rubxkube 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
flaresolverr/flaresolverr:v3.5.0139dfee1c6f8
jaraco-context@5.3.0
6.1.0

Open the chart page →

27,274
transmissionryuunosukeds31.6.21 of 2See more

transmission ryuunosukeds3 1.6.2

1 of the 2 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
library/python:3.9da5aee29682d
jaraco-context@5.3.0
6.1.0

Open the chart page →

9,534
mlflowsb-helm-charts0.3.01 of 1See more

mlflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
library/python:3.11-slim9534e5a8e315
jaraco-context@5.3.0
6.1.0

Open the chart page →

888
mysqlsb-helm-charts0.4.01 of 1See more

mysql sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
library/mysql:8.4.3106d5197fd8e
jaraco-context@5.3.0
6.1.0

Open the chart page →

1,096
pgadminsb-helm-charts0.3.01 of 1See more

pgadmin sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
dpage/pgadmin4:8.13561c1f8f99f2
jaraco-context@6.0.1
6.1.0

Open the chart page →

1,713
scapyscapy-containerised0.3.41 of 2See more

scapy scapy-containerised 0.3.4

1 of the 2 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
saidsef/scapy-containerised:v2025.02f17f7c435891
jaraco-context@5.3.0
6.1.0

Open the chart page →

2,817
seawise-dashboardseawiseVerified publisher1.7.11 of 1See more

seawise-dashboard seawise 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
shwcloud/seawise-backup:v1.7.1a97479a54df4
jaraco-context@5.3.0
6.1.0

Open the chart page →

1,080
ccx-monitoringseveralnines0.6.211 of 7See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
jaraco-context@5.3.0
6.1.0

Open the chart page →

7,708
sibylsibyl0.2.01 of 1See more

sibyl sibyl 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/bensoer/sibyl:v0.2.06dca4455fde3
jaraco-context@5.3.0
6.1.0

Open the chart page →

1,020
smtpsmtpVerified publisher1.3.31 of 1See more

smtp smtp 1.3.3

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
jaraco-context@5.3.0
6.1.0

Open the chart page →

1,437
cost-analyzersoftonic2.5.52 of 6See more

cost-analyzer softonic 2.5.5

2 of the 6 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
gcr.io/kubecost1/kubecost-modeling:v0.1.24a2259b098b13
jaraco-context@6.0.1
6.1.0
ghcr.io/kiwigrid/k8s-sidecar:1.29.142002d66ddb3
jaraco-context@5.3.0
6.1.0

Open the chart page →

7,901
kube-prometheus-stacksoftonic81.5.11 of 6See more

kube-prometheus-stack softonic 81.5.1

1 of the 6 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
jaraco-context@5.3.0
6.1.0

Open the chart page →

4,974
servicexssl-hep1.8.57 of 16See more

servicex ssl-hep 1.8.5

7 of the 16 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
library/python:3.1070c9cc675605
jaraco-context@5.3.0
6.1.0
sslhep/servicex_code_gen_atlas_xaod:v1.8.5e7aff7f97b89
jaraco-context@5.3.0
6.1.0
sslhep/servicex_code_gen_func_adl_uproot:v1.8.5b01b8ee966ed
jaraco-context@5.3.0
6.1.0
sslhep/servicex_code_gen_python:v1.8.50e4175a4e1eb
jaraco-context@5.3.0
6.1.0
sslhep/servicex_code_gen_raw_uproot:v1.8.5671980005c57
jaraco-context@5.3.0
6.1.0
sslhep/servicex_code_gen_topcp:v1.8.5596db2abdd09
jaraco-context@5.3.0
6.1.0
sslhep/servicex-did-finder-cernopendata:v1.8.52cb88ceab5bb
jaraco-context@5.3.0
6.1.0

Open the chart page →

66,266
verostakewise0.8.31 of 2See more

vero stakewise 0.8.3

1 of the 2 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/serenita-org/vero:v0.8.3e5a7ec714acc
jaraco-context@5.3.0
6.1.0

Open the chart page →

3,458
open-appsec-injectorstartechnicaVerified publisher1.1.21 of 3See more

open-appsec-injector startechnica 1.1.2

1 of the 3 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/openappsec/openappsec-waf-webhook:1.1.345b979b962043
jaraco-context@5.3.0
6.1.0

Open the chart page →

4,303
substra-backendsubstraVerified publisher26.15.31 of 7See more

substra-backend substra 26.15.3

1 of the 7 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/substra/substra-backend:1.0.121967f54ec86
jaraco-context@5.3.0
6.1.0

Open the chart page →

4,731
stashswuuper-githubVerified publisher0.1.161 of 1See more

stash swuuper-github 0.1.16

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
stashapp/stash:v0.31.1df744af5a0c9
jaraco-context@5.3.0
6.1.0

Open the chart page →

2,396
traefik-external-dns-controllertraefik-external-dns-operator2.2.01 of 1See more

traefik-external-dns-controller traefik-external-dns-operator 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ybucci/traefik-external-dns-controller:2.2.08d27ad8b5f73
jaraco-context@5.3.0
6.1.0

Open the chart page →

1,484
tfy-grafanatruefoundryVerified publisher0.1.211 of 3See more

tfy-grafana truefoundry 0.1.21

1 of the 3 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
jaraco-context@5.3.0
6.1.0

Open the chart page →

1,062
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
jaraco-context@5.3.0
6.1.0

Open the chart page →

4,526
zookeepertwomartensVerified publisher0.2.21 of 1See more

zookeeper twomartens 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
confluentinc/cp-zookeeper:latest7610a50b13e7
jaraco-context@5.3.0
6.1.0

Open the chart page →

1,733
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.252cb72a9e3da
jaraco-context@5.3.0
6.1.0

Open the chart page →

4,768
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
jaraco-context@5.3.0
6.1.0

Open the chart page →

7,628
xboardxboard0.2.01 of 1See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/cedar2025/xboard:latest896e4926e0d7
jaraco-context@5.3.0
6.1.0

Open the chart page →

1,042
helm-demoyahoon-helm-demoVerified publisher1.0.01 of 1See more

helm-demo yahoon-helm-demo 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-23949.

Container imageDigestPackageFixed in
ghcr.io/yahoon/helm-demo:1.0.02930290a758c
jaraco-context@5.3.0
6.1.0

Open the chart page →

1,281

Container images carrying it

234 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
jaraco-context@5.3.0
6.1.0
1
ghcr.io/sdr-enthusiasts/docker-flightradar24:latest917e53402d51
jaraco-context@6.0.1
setuptools@78.1.1-0.1
6.1.0
no fix listed
1
ghcr.io/seanmorley15/adventurelog-backend:v0.13.00250d9cb0d74
jaraco-context@6.0.1
setuptools@78.1.1-0.1
6.1.0
no fix listed
1
ghcr.io/serenita-org/vero:v0.8.3e5a7ec714acc
jaraco-context@5.3.0
6.1.0
1
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
jaraco-context@6.0.1
6.1.0
1
ghcr.io/substra/substra-backend:1.0.121967f54ec86
jaraco-context@5.3.0
6.1.0
1
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
jaraco-context@5.3.0
6.1.0
1
ghcr.io/texano00/urunner:0.6.07c8be1dae3cd
jaraco-context@5.3.0
6.1.0
1
ghcr.io/timothepoznanski/poznote:6.80.0045035db3a20
jaraco-context@5.3.0
6.1.0
1
ghcr.io/virtuos/librechat_exporter:2.0.050ea1cf0086f
jaraco-context@5.3.0
6.1.0
1
ghcr.io/yahoon/helm-demo:1.0.02930290a758c
jaraco-context@5.3.0
6.1.0
1
ghcr.io/zazukoians/qlever-ui:v0.10.034c7b540a095
jaraco-context@5.3.0
6.1.0
1
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
jaraco-context@5.3.0
6.1.0
1
public.ecr.aws/aktosecurity/akto-ai-automated-testing:latest5a5d32281374
jaraco-context@5.3.0
6.1.0
1
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
jaraco-context@5.3.0
6.1.0
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
jaraco-context@5.3.0
6.1.0
1
public.ecr.aws/r3m4q3r9/pleco:0.24.0651739583336
jaraco-context@5.3.0
6.1.0
1
quay.io/ceph/ceph:v21.1.05ff3692d2f3f
jaraco-context@6.0.1
6.1.0
1
quay.io/clustersecret/clustersecret:0.0.14a9f835d1b241
jaraco-context@5.3.0
6.1.0
1
quay.io/hpestorage/filex-csi-driver:2.6.4b7f960bbf472
jaraco-context@5.3.0
6.1.0
1
quay.io/kiali/kiali-operator:v2.31.0f837d8f25545
jaraco-context@5.3.0
6.1.0
1
quay.io/kiwigrid/k8s-sidecar:1.30.349dcce269568
jaraco-context@5.3.0
6.1.0
1
quay.io/kiwigrid/k8s-sidecar:1.30.10835d79d8fbae
jaraco-context@5.3.0
6.1.0
1
quay.io/netscaler/netscaler-k8s-ingress-controller:4.1.1755b12c2a8440
jaraco-context@5.3.0
6.1.0
1
quay.io/netscaler/netscaler-k8s-ingress-controller:4.2.26a68453858339
jaraco-context@5.3.0
6.1.0
1
quay.io/ocellusai/operator:v0.10.59ff01f642e2b
jaraco-context@5.3.0
6.1.0
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
jaraco-context@6.0.1
6.1.0
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
jaraco-context@6.0.1
6.1.0
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
jaraco-context@6.0.1
6.1.0
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
jaraco-context@6.0.1
6.1.0
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
jaraco-context@6.0.1
6.1.0
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
jaraco-context@6.0.1
6.1.0
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
jaraco-context@6.0.1
6.1.0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
jaraco-context@5.3.0
6.1.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.