StackRadar

CVE-2026-24049

High

Advisory

Published 22 Jan 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.1
base score, highest
EPSS
0.003
25th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
491
of 17,781 indexed, latest versions
Container images
508
deployed by those charts
Fix available
3 of 4
affected packages

Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack

Carried by container images the latest versions of 491 of 17,781 indexed charts deploy, on 508 images.

Affected packageAffected versionsFixed inImages
wheelpypi0.40.0, 0.41.0, 0.41.1, 0.41.2+7 more0.46.2445
python-pipdeb1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+12 moreno fix listed64
wheeldeb0.42.0-2, 0.46.1-20.42.0-2ubuntu0.1~esm126
py3-setuptoolsapk75.8.0-r0, 80.9.0-r280.10.2-r02
OSV records
CGA-8262-rvw7-ph6vCGA-m596-w84m-mmc5GHSA-8rrh-rw8j-w5fxUBUNTU-CVE-2026-24049DEBIAN-CVE-2026-24049
Also known as
CGA-pc3r-mrfq-gqw5, CGA-qh9c-67fv-jhj9, PYSEC-2026-2047, USN-8221-1

Charts affected

491 by stars
ChartLatestAffected imagesRadar Score
cronjobt3n0.1.01 of 1See more

cronjob t3n 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
library/python:3.8d41127070014
wheel@0.44.0
0.46.2

Open the chart page →

11,199
democharttech-challenge0.1.02 of 4See more

demochart tech-challenge 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
alexvm6/generator:latestfb99ee4f760a
wheel@0.40.0
0.46.2
alexvm6/pythonalex:latest89a05786879c
wheel@0.40.0
0.46.2

Open the chart page →

3,632
rundeck-exportertechpreta0.1.91 of 1See more

rundeck-exporter techpreta 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
phsmith/rundeck-exporter:2.6.10265a7616ae8
wheel@0.40.0
0.46.2

Open the chart page →

1,105
asrtest-opea1.0.01 of 1See more

asr test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
opea/asr:1.025dd26d9cd09
wheel@0.44.0
0.46.2

Open the chart page →

4,393
chatqnatest-opea1.0.05 of 11See more

chatqna test-opea 1.0.0

5 of the 11 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
opea/chatqna:1.038c51b791efa
wheel@0.44.0
0.46.2
opea/embedding-tei:1.05c9639de61c1
wheel@0.44.0
0.46.2
opea/llm-tgi:1.00c25aab3f106
wheel@0.44.0
0.46.2
opea/reranking-tei:1.0e48613afb191
wheel@0.44.0
0.46.2
opea/retriever-redis:1.0eb746b263705
wheel@0.44.0
0.46.2

Open the chart page →

39,090
codegentest-opea1.0.02 of 5See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
opea/codegen:1.058f91683892d
wheel@0.44.0
0.46.2
opea/llm-tgi:1.00c25aab3f106
wheel@0.44.0
0.46.2

Open the chart page →

28,814
codetranstest-opea1.0.02 of 5See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
opea/codetrans:1.0e2436483b73d
wheel@0.44.0
0.46.2
opea/llm-tgi:1.00c25aab3f106
wheel@0.44.0
0.46.2

Open the chart page →

28,385
docsumtest-opea1.0.02 of 5See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
opea/docsum:1.03eaa91849512
wheel@0.44.0
0.46.2
opea/llm-docsum-tgi:1.002f9e8fa5d71
wheel@0.44.0
0.46.2

Open the chart page →

28,858
embedding-usvctest-opea1.0.01 of 1See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
wheel@0.44.0
0.46.2

Open the chart page →

5,185
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
wheel@0.44.0
0.46.2

Open the chart page →

5,221
llm-uservicetest-opea1.0.01 of 1See more

llm-uservice test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
opea/llm-tgi:1.00c25aab3f106
wheel@0.44.0
0.46.2

Open the chart page →

4,720
reranking-usvctest-opea1.0.01 of 1See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
opea/reranking-tei:1.0e48613afb191
wheel@0.44.0
0.46.2

Open the chart page →

4,985
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
wheel@0.44.0
0.46.2

Open the chart page →

5,198
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
wheel@0.44.0
0.46.2

Open the chart page →

9,616
ttstest-opea1.0.01 of 1See more

tts test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
opea/tts:1.0257ae94709e9
wheel@0.44.0
0.46.2

Open the chart page →

4,377
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
wheel@0.44.0
0.46.2

Open the chart page →

5,350
thanhvt27-lab-k8sthanh-vtVerified publisher0.1.41 of 5See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
pysga1996/python-redis-web:latestfdeec30ad482
wheel@0.40.0
0.46.2

Open the chart page →

4,661
kasa-exporterth-chartsVerified publisher0.1.01 of 1See more

kasa-exporter th-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
thelande/kasa_exporter:v0.2.3a1fdb8baa152
wheel@0.43.0
0.46.2

Open the chart page →

1,515
todolist-charttodolist-chart0.1.71 of 10See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
erenozcan17/flask_analytics:v3.1c9b6f0dfbffc
wheel@0.45.1
0.46.2

Open the chart page →

6,973
traefik-external-dns-controllertraefik-external-dns-operator2.2.01 of 1See more

traefik-external-dns-controller traefik-external-dns-operator 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
ybucci/traefik-external-dns-controller:2.2.08d27ad8b5f73
wheel@0.45.1
0.46.2

Open the chart page →

1,484
orchestratremolo3.1.551 of 5See more

orchestra tremolo 3.1.55

1 of the 5 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
ghcr.io/tremolosecurity/python-slim-nonroot/python3:1.0.079bb14620fe9
wheel@0.40.0
0.46.2

Open the chart page →

7,637
tfy-grafanatruefoundryVerified publisher0.1.211 of 3See more

tfy-grafana truefoundry 0.1.21

1 of the 3 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
wheel@0.45.1
0.46.2

Open the chart page →

1,062
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
wheel@0.45.1
0.46.2

Open the chart page →

4,526
zookeepertwomartensVerified publisher0.2.21 of 1See more

zookeeper twomartens 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
confluentinc/cp-zookeeper:latest7610a50b13e7
wheel@0.43.0
0.46.2

Open the chart page →

1,733
demo-backendv2flyVerified publisher0.0.31 of 1See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
wheel@0.41.1
0.46.2

Open the chart page →

14,358
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.252cb72a9e3da
wheel@0.43.0
0.46.2

Open the chart page →

4,768
telegram-rebotvcnngrVerified publisher1.0.02 of 3See more

telegram-rebot vcnngr 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
vcnngr/telegram-login:latest1a849a997b6d
wheel@0.45.1
0.46.2
vcnngr/telegram-rebot:latest30f1f05e57a6
wheel@0.45.1
0.46.2

Open the chart page →

5,026
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
wheel@0.42.0-2
wheel@0.42.0
0.42.0-2ubuntu0.1~esm1
0.46.2

Open the chart page →

4,305
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
wheel@0.45.1
0.46.2

Open the chart page →

7,628
vote-appvote-appVerified publisher1.0.71 of 6See more

vote-app vote-app 1.0.7

1 of the 6 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
thecloudspark/app-vote:1.0c7da7417a86a
wheel@0.43.0
0.46.2

Open the chart page →

3,031
aih-scannerwallarmVerified publisher2.7.111 of 2See more

aih-scanner wallarm 2.7.11

1 of the 2 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
wallarm/aih-scanner:2.7.11f1cb26db1f5b
wheel@0.46.1
wheel@0.46.1-2
0.46.2
no fix listed

Open the chart page →

3,911
wallarm-node-nextwallarmVerified publisher0.5.31 of 2See more

wallarm-node-next wallarm 0.5.3

1 of the 2 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
wallarm/node-helpers:5.0.2-1097cadc42336
wheel@0.43.0
0.46.2

Open the chart page →

2,408
wallarm-oobwallarmVerified publisher0.23.01 of 3See more

wallarm-oob wallarm 0.23.0

1 of the 3 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
wallarm/node-helpers:6.10.1aecd88b24c51
wheel@0.45.1
0.46.2

Open the chart page →

2,824
supersetwbstack0.1.01 of 1See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
apache/superset:4.0.1ab9467fd712c
wheel@0.43.0
0.46.2

Open the chart page →

7,085
welcome-elos-webappwelcome-elos-webappVerified publisher2.0.01 of 1See more

welcome-elos-webapp welcome-elos-webapp 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
pococze/python-hello-elos:2.0.07a1aab425e51
wheel@0.44.0
0.46.2

Open the chart page →

2,678
emissary-ingresswenerme8.12.21 of 2See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
datawire/emissary:3.12.21f67a1292d2a
wheel@0.45.1
0.46.2

Open the chart page →

10,843
juicefs-csi-driverwenerme0.32.51 of 5See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.32.595008ba63318
wheel@0.45.1
0.46.2

Open the chart page →

9,117
marge-botwiremindVerified publisher1.4.41 of 1See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
hiboxsystems/marge-bot:0.14.0dcffb926e563
wheel@0.42.0
0.46.2

Open the chart page →

5,542
xboardxboard0.2.01 of 1See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
ghcr.io/cedar2025/xboard:latest896e4926e0d7
wheel@0.45.1
0.46.2

Open the chart page →

1,042
xkopsxkops0.1.03 of 5See more

xkops xkops 0.1.0

3 of the 5 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
hamzaarshad10/querybackend:1.6.22c1c3b86a8e7
wheel@0.44.0
0.46.2
hamzaarshad10/querypodpy:1.7154f38e8668e
wheel@0.44.0
0.46.2
murtazashah46/helmfile:latest4d11726cf803
wheel@0.44.0
0.46.2

Open the chart page →

13,677
helm-demoyahoon-helm-demoVerified publisher1.0.01 of 1See more

helm-demo yahoon-helm-demo 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-24049.

Container imageDigestPackageFixed in
ghcr.io/yahoon/helm-demo:1.0.02930290a758c
wheel@0.45.1
0.46.2

Open the chart page →

1,281

Container images carrying it

508 by charts deploying them

A fixed version is listed for 3 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
sysnet4admin/colosseum-rwd:log74ded2d92f07
wheel@0.45.1
0.46.2
1
szurubooru/server:2.5accf2ad9fbc3
wheel@0.45.1
0.46.2
1
teknas09/bird-pod:latest12a1fa85c4aa
wheel@0.43.0
0.46.2
1
thecloudspark/app-vote:1.0c7da7417a86a
wheel@0.43.0
0.46.2
1
thelande/kasa_exporter:v0.2.3a1fdb8baa152
wheel@0.43.0
0.46.2
1
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
wheel@0.46.1
wheel@0.46.1-2
0.46.2
no fix listed
1
thijsvanloef/palworld-server-docker:v2.5.0b4ac9ee22483
wheel@0.46.1
wheel@0.46.1-2
0.46.2
no fix listed
1
thongngo3301/stakefish:latesta341af5976e3
wheel@0.41.2
0.46.2
1
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
wheel@0.43.0
0.46.2
1
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
python-pip@8.1.1-2ubuntu0.4
no fix listed
1
tinymediamanager/tinymediamanager:5.3.22b34dc85099e
wheel@0.45.1
0.46.2
1
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
wheel@0.45.1
0.46.2
1
tomsajan/netio-exporter:0.0.5fb61907707b8
wheel@0.43.0
0.46.2
1
tomsquest/docker-radicale:3.6.1.0a594c624c5a6
wheel@0.45.1
0.46.2
1
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
wheel@0.43.0
0.46.2
1
vabene1111/recipes:2.3.50f8d061895e9
wheel@0.45.1
0.46.2
1
vcnngr/telegram-login:latest1a849a997b6d
wheel@0.45.1
0.46.2
1
vcnngr/telegram-rebot:latest30f1f05e57a6
wheel@0.45.1
0.46.2
1
voltha/voltha-cli:1.6.0c4e41e92f046
python-pip@8.1.1-2ubuntu0.4
no fix listed
1
voltha/voltha-netconf:1.6.037f80524c207
python-pip@8.1.1-2ubuntu0.4
no fix listed
1
voltha/voltha-ofagent:1.6.09ee8c1f4428c
python-pip@8.1.1-2ubuntu0.4
no fix listed
1
voltha/voltha-tester:1.7.0655c3048a602
python-pip@8.1.1-2ubuntu0.4
no fix listed
1
voltha/voltha-voltha:1.6.0ff596b62de59
python-pip@8.1.1-2ubuntu0.4
no fix listed
1
wallarm/aih-scanner:2.7.11f1cb26db1f5b
wheel@0.46.1
wheel@0.46.1-2
0.46.2
no fix listed
1
wallarm/node-helpers:5.0.2-1097cadc42336
wheel@0.43.0
0.46.2
1
wallarm/node-helpers:6.10.1aecd88b24c51
wheel@0.45.1
0.46.2
1
wazuh/wazuh-manager:4.14.3f09282d281f6
wheel@0.45.1
0.46.2
1
ybucci/traefik-external-dns-controller:2.2.08d27ad8b5f73
wheel@0.45.1
0.46.2
1
yetiplatform/yeti:2.9.09bcbe2650a14
wheel@0.45.1
0.46.2
1
yetiplatform/yeti:latest9c3006cedcca
wheel@0.45.1
0.46.2
1
ymuski/geo-checker:5.0.05ba7fd8c7bdc
wheel@0.45.1
0.46.2
1
youssef11gaber10/deployment-weather-flask:latest96bce8b8b5a7
wheel@0.40.0
0.46.2
1
youssef11gaber10/flask-service:latest9c727fcfde76
wheel@0.45.1
0.46.2
1
gcr.io/getindata-images-public/mlflow:latest25d6975951f1
wheel@0.43.0
0.46.2
1
gcr.io/kubecost1/kubecost-modeling:v0.1.24a2259b098b13
wheel@0.43.0
0.46.2
1
gcr.io/kubecost1/kubecost-modeling:v0.1.22a461dc5cb96a
wheel@0.43.0
0.46.2
1
gcr.io/ml-pipeline/metadata-writer:2.3.09bcfd2abc361
wheel@0.44.0
0.46.2
1
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
wheel@0.45.1
0.46.2
1
ghcr.io/abcdesktopio/route:4.449c972229c6b
wheel@0.45.1
0.46.2
1
ghcr.io/angelscloud/prometheus-optimizer:latest744bc929a579
wheel@0.44.0
0.46.2
1
ghcr.io/appscode/gotenberg:8.25f9104080d9a7
wheel@0.45.1
0.46.2
1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
wheel@0.45.1
0.46.2
1
ghcr.io/bensoer/external-secrets-reloader:v0.1.38e31b5a81853
wheel@0.45.1
0.46.2
1
ghcr.io/bensoer/sibyl:v0.2.06dca4455fde3
wheel@0.45.1
0.46.2
1
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
py3-setuptools@80.9.0-r2
wheel@0.45.1
80.10.2-r0
0.46.2
1
ghcr.io/b-it-projects-gmbh/nvme_exporter:lateste70307b193c6
wheel@0.45.1
0.46.2
1
ghcr.io/browserless/chrome:v2.56.7d600eac6283f
wheel@0.42.0-2
wheel@0.42.0
0.42.0-2ubuntu0.1~esm1
0.46.2
1
ghcr.io/browserless/chromium:v2.55.42ed0183564d7
wheel@0.42.0-2
wheel@0.42.0
0.42.0-2ubuntu0.1~esm1
0.46.2
1
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
wheel@0.42.0-2
wheel@0.42.0
0.42.0-2ubuntu0.1~esm1
0.46.2
1
ghcr.io/cedar2025/xboard:latest896e4926e0d7
wheel@0.45.1
0.46.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.