StackRadar

CVE-2026-24049

High

Advisory

Published 22 Jan 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.1
base score, highest
EPSS
0.003
25th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
493
of 17,787 indexed, latest versions
Container images
511
deployed by those charts
Fix available
3 of 4
affected packages

Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack

Carried by container images the latest versions of 493 of 17,787 indexed charts deploy, on 511 images.

Affected packageAffected versionsFixed inImages
wheelpypi0.40.0, 0.41.0, 0.41.1, 0.41.2+7 more0.46.2448
python-pipdeb1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+12 moreno fix listed64
wheeldeb0.42.0-2, 0.46.1-20.42.0-2ubuntu0.1~esm127
py3-setuptoolsapk75.8.0-r0, 80.9.0-r280.10.2-r02
OSV records
CGA-8262-rvw7-ph6vCGA-m596-w84m-mmc5GHSA-8rrh-rw8j-w5fxUBUNTU-CVE-2026-24049DEBIAN-CVE-2026-24049
Also known as
CGA-pc3r-mrfq-gqw5, CGA-qh9c-67fv-jhj9, PYSEC-2026-2047, USN-8221-1

Charts affected

493 by stars
ChartLatestAffected imagesRadar Score
supersethelm-charts-nr1.1.31 of 1See more

superset helm-charts-nr 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
wheel@0.45.1
0.46.2

Open the chart page →

2,214
appwritehelmforgeVerified publisher1.3.41 of 5See more

appwrite helmforge 1.3.4

1 of the 5 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
appwrite/appwrite:1.9.6adc7d0e7ec23
wheel@0.45.1
0.46.2

Open the chart page →

7,010
archiveboxhelmforgeVerified publisher1.1.121 of 1See more

archivebox helmforge 1.1.12

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
archivebox/archivebox:0.7.41a5a37331091
wheel@0.45.1
0.46.2

Open the chart page →

7,648
changedetectionhelmforgeVerified publisher1.1.151 of 1See more

changedetection helmforge 1.1.15

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.3ecacd9fd0c66
wheel@0.45.1
0.46.2

Open the chart page →

2,602
immichhelmforgeVerified publisher1.2.81 of 5See more

immich helmforge 1.2.8

1 of the 5 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v3.1.05a0839dc5303
wheel@0.45.1
0.46.2

Open the chart page →

11,080
middlewarehelmforgeVerified publisher1.2.61 of 4See more

middleware helmforge 1.2.6

1 of the 4 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
middlewareeng/middleware:0.3.1747d880812f1
wheel@0.45.1
0.46.2

Open the chart page →

9,704
notediscoveryhelmforgeVerified publisher2.0.11 of 1See more

notediscovery helmforge 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
ghcr.io/gamosoft/notediscovery:0.31.5c06aa0fa9a85
wheel@0.45.1
0.46.2

Open the chart page →

1,238
poznotehelmforgeVerified publisher2.0.21 of 1See more

poznote helmforge 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
ghcr.io/timothepoznanski/poznote:6.80.0045035db3a20
wheel@0.45.1
0.46.2

Open the chart page →

483
supersethelmforgeVerified publisher1.3.61 of 5See more

superset helmforge 1.3.6

1 of the 5 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
apache/superset:6.1.016b50bbef664
wheel@0.45.1
0.46.2

Open the chart page →

5,649
myapphelmingapp0.1.01 of 1See more

myapp helmingapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
muhammedgamal/fp23:latest74b4cd69b6fa
wheel@0.43.0
0.46.2

Open the chart page →

11,441
paperlesshomelabcihelmchartstestVerified publisher9.1.91 of 1See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
wheel@0.42.0
0.46.2

Open the chart page →

14,629
paperlesshpVerified publisher0.1.11 of 5See more

paperless hp 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.3467097317623a
wheel@0.45.1
0.46.2

Open the chart page →

26,579
httpbin2022httpbin2022Verified publisher0.1.11 of 1See more

httpbin2022 httpbin2022 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
mshanley80/httpbin2022:latest5b189a70c0fb
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

8,732
activation-servicei4trustVerified publisher2.3.11 of 1See more

activation-service i4trust 2.3.1

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
i4trust/activation-service:2.2.09f3719176893
wheel@0.40.0
0.46.2

Open the chart page →

2,057
ibexaibexaVerified publisher3.11.11 of 10See more

ibexa ibexa 3.11.1

1 of the 10 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
library/mysql:8.0.41bf577825b52a
wheel@0.43.0
0.46.2

Open the chart page →

5,770
browserlessicoretechVerified publisher0.16.61 of 1See more

browserless icoretech 0.16.6

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.56.7b1ba7b054af2
wheel@0.42.0-2
wheel@0.42.0
0.42.0-2ubuntu0.1~esm1
0.46.2

Open the chart page →

2,002
monitoring-stackict-platformVerified publisher0.4.01 of 13See more

monitoring-stack ict-platform 0.4.0

1 of the 13 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
wheel@0.45.1
0.46.2

Open the chart page →

9,597
bluesky-pdsijmacd1.0.01 of 2See more

bluesky-pds ijmacd 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
arunvelsriram/utils:latest655ad18fd8d6
wheel@0.42.0-2
wheel@0.42.0
0.42.0-2ubuntu0.1~esm1
0.46.2

Open the chart page →

9,032
ikigaiikigai-chartVerified publisher0.0.91 of 58See more

ikigai ikigai-chart 0.0.9

1 of the 58 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:1.2.0e4770285aaf7
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

37,844
healthchecksimprowisedVerified publisher1.1.11 of 2See more

healthchecks improwised 1.1.1

1 of the 2 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
linuxserver/healthchecks:2.7.2023033194696dab3c50
wheel@0.40.0
0.46.2

Open the chart page →

2,628
guardrails-usvcinfracloud-chartsVerified publisher1.0.11 of 1See more

guardrails-usvc infracloud-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
opea/guardrails-tgi:latestf68bec6a1271
wheel@0.45.1
0.46.2

Open the chart page →

5,069
label-studioinseefrlab2.3.11 of 3See more

label-studio inseefrlab 2.3.1

1 of the 3 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
heartexlabs/label-studio:latestaa461572e8f9
wheel@0.45.1
0.46.2

Open the chart page →

3,157
gmaintelVerified publisher0.1.01 of 1See more

gma intel 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
smartedge/generic-multi-access-network-virtualization:1.04cd63c22ce36
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

7,697
itm-servicesintelVerified publisher2.0.01 of 8See more

itm-services intel 2.0.0

1 of the 8 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
intel/dlstreamer-pipeline-server:2022.1.1-ubuntu20aa8f5483a2ef
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

18,137
map5gintelVerified publisher1.0.01 of 1See more

map5g intel 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
smartedge/generic-multi-access-network-virtualization:1.04cd63c22ce36
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

7,697
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
wheel@0.45.1
0.46.2

Open the chart page →

16,558
twitch-channel-points-minerjacobcolvinVerified publisher0.1.01 of 1See more

twitch-channel-points-miner jacobcolvin 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
rdavidoff/twitch-channel-points-miner-v2:1.8.67ae4c5135771
wheel@0.40.0
0.46.2

Open the chart page →

1,088
kweather-chartjamoos0.1.01 of 1See more

kweather-chart jamoos 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
jamoos/kweather:history163e2e8a6e87
wheel@0.44.0
0.46.2

Open the chart page →

607
ja-shortenerja-shortenerVerified publisher0.1.01 of 2See more

ja-shortener ja-shortener 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
cr0hn/ja-shortener:v0.1.414482d0bc4a1
wheel@0.45.1
0.46.2

Open the chart page →

2,090
13ftjeffrescVerified publisher0.2.01 of 1See more

13ft jeffresc 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
ghcr.io/wasi-master/13ft:0.3.4563ce7794a71
wheel@0.43.0
0.46.2

Open the chart page →

887
homebridgejespernohrVerified publisher0.2.01 of 1See more

homebridge jespernohr 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
homebridge/homebridge:latest77c685a40911
wheel@0.42.0-2
wheel@0.42.0
0.42.0-2ubuntu0.1~esm1
0.46.2

Open the chart page →

2,203
palworld-serverk8s-chartsVerified publisher1.2.11 of 1See more

palworld-server k8s-charts 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
thijsvanloef/palworld-server-docker:v2.5.0b4ac9ee22483
wheel@0.46.1
wheel@0.46.1-2
0.46.2
no fix listed

Open the chart page →

3,433
beetsk8s-home-lab-repo3.1.11 of 1See more

beets k8s-home-lab-repo 3.1.1

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
wheel@0.45.1
0.46.2

Open the chart page →

2,732
flaresolverrk8s-home-lab-repo6.2.01 of 1See more

flaresolverr k8s-home-lab-repo 6.2.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
flaresolverr/flaresolverr:v3.5.0139dfee1c6f8
wheel@0.45.1
0.46.2

Open the chart page →

27,282
netio-exporterk8sonlabVerified publisher0.1.101 of 1See more

netio-exporter k8sonlab 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
tomsajan/netio-exporter:0.0.5fb61907707b8
wheel@0.43.0
0.46.2

Open the chart page →

728
authentikkagiso-me0.1.11 of 1See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
wheel@0.45.1
0.46.2

Open the chart page →

4,539
huekatool1.0.81 of 1See more

hue katool 1.0.8

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
gethue/hue:4.11.011b649636e68
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

16,464
kbot-self-hostedkbot-self-hostedVerified publisher0.1.81 of 7See more

kbot-self-hosted kbot-self-hosted 0.1.8

1 of the 7 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.30206a6c708fc6
wheel@0.45.1
0.46.2

Open the chart page →

32,522
allurekfirfer0.1.81 of 2See more

allure kfirfer 0.1.8

1 of the 2 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
frankescobar/allure-docker-service:2.21.08a4d7e9308de
python-pip@9.0.1-2.3~ubuntu1.18.04.6
no fix listed

Open the chart page →

12,541
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
wheel@0.41.2
0.46.2

Open the chart page →

6,446
mysqldumpkfirfer2.8.01 of 1See more

mysqldump kfirfer 2.8.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
kfirfer/gcloud-mysql:1.0.3c257c1e0e8b9
wheel@0.42.0
0.46.2

Open the chart page →

3,506
slackgptkfirfer0.0.61 of 1See more

slackgpt kfirfer 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
kfirfer/slackgpt:0.0.15461331bd838e
wheel@0.41.2
0.46.2

Open the chart page →

1,125
kovi-appkovi-charts0.8.11 of 1See more

kovi-app kovi-charts 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
kennethreitz/httpbin:latest599fe5e50731
python-pip@9.0.1-2.3~ubuntu1
no fix listed

Open the chart page →

14,827
kubeflowkromanow94-kubeflow0.5.16 of 30See more

kubeflow kromanow94-kubeflow 0.5.1

6 of the 30 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
kserve/models-web-app:v0.13.073486345a602
wheel@0.43.0
0.46.2
kubeflownotebookswg/jupyter-web-app:v1.9.2afb52057c997
wheel@0.44.0
0.46.2
kubeflownotebookswg/tensorboards-web-app:v1.9.277f07f52a84a
wheel@0.44.0
0.46.2
kubeflownotebookswg/volumes-web-app:v1.9.2f63c3e550af3
wheel@0.44.0
0.46.2
library/python:3.7eedf63967cdb
wheel@0.41.2
0.46.2
gcr.io/ml-pipeline/metadata-writer:2.3.09bcfd2abc361
wheel@0.44.0
0.46.2

Open the chart page →

68,994
lnbitskronkltdVerified publisher0.1.01 of 1See more

lnbits kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
lnbitsdocker/lnbits-legend:latest26fae6327477
wheel@0.42.0
0.46.2

Open the chart page →

1,444
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
wheel@0.45.1
0.46.2

Open the chart page →

9,652
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
wheel@0.45.1
0.46.2

Open the chart page →

8,455
jupyterhubkubeblocksVerified publisher0.1.02 of 7See more

jupyterhub kubeblocks 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
wheel@0.41.1
0.46.2
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
wheel@0.41.1
0.46.2

Open the chart page →

7,356
lokikubeblocksVerified publisher5.39.01 of 5See more

loki kubeblocks 5.39.0

1 of the 5 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.24.35af76eebbba7
wheel@0.40.0
0.46.2

Open the chart page →

5,841
juicefs-csi-driverkubegems0.19.21 of 6See more

juicefs-csi-driver kubegems 0.19.2

1 of the 6 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.23.0d915e899e322
wheel@0.41.3
0.46.2

Open the chart page →

4,825

Container images carrying it

511 by charts deploying them

A fixed version is listed for 3 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/kiwigrid/k8s-sidecar:1.30.10835d79d8fbae
wheel@0.45.1
0.46.2
1
quay.io/kiwigrid/k8s-sidecar:1.25.2cb4c638ffb1f
wheel@0.41.2
0.46.2
1
quay.io/maxiv/storageclass-router:0.4.160725dab588c
wheel@0.42.0
0.46.2
1
quay.io/netscaler/netscaler-k8s-ingress-controller:4.1.1755b12c2a8440
wheel@0.45.1
0.46.2
1
quay.io/netscaler/netscaler-k8s-ingress-controller:4.2.26a68453858339
wheel@0.45.1
0.46.2
1
quay.io/ocellusai/operator:v0.10.59ff01f642e2b
wheel@0.45.1
0.46.2
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
wheel@0.41.1
0.46.2
1
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
wheel@0.42.0-2
wheel@0.42.0
0.42.0-2ubuntu0.1~esm1
0.46.2
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
python-pip@20.0.2-5ubuntu1.1
no fix listed
1
registry.gitlab.com/radiology/infrastructure/study-governor:8.0.04e7faf6f8d5f
wheel@0.42.0
0.46.2
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
wheel@0.45.1
0.46.2
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.