StackRadar

CVE-2026-27606

Critical

Advisory

Published 25 Feb 2026In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.3
base score, highest
EPSS
0.015
72nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
66
of 17,781 indexed, latest versions
Container images
64
deployed by those charts
Fix available
1 of 1
affected package

Rollup 4 has Arbitrary File Write via Path Traversal

Carried by container images the latest versions of 66 of 17,781 indexed charts deploy, on 64 images.

Affected packageAffected versionsFixed inImages
rollupnpm0.50.1, 1.32.1, 2.71.1, 2.72.1+28 more2.80.0, 3.30.0, 4.59.064
OSV records
GHSA-mw96-cpmx-2vgc

Charts affected

66 by stars
ChartLatestAffected imagesRadar Score
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-27606.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
rollup@4.2.0
4.59.0

Open the chart page →

7,413
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-27606.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
rollup@4.53.3
4.59.0

Open the chart page →

5,819
outlineschmitzis0.0.81 of 4See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-27606.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
rollup@3.14.0
3.30.0

Open the chart page →

4,431
semaphoreschoenwald0.1.31 of 1See more

semaphore schoenwald 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-27606.

Container imageDigestPackageFixed in
0hlov3/semaphore:v1.0.050f874ec096b
rollup@2.79.1
2.80.0

Open the chart page →

1,796
secret-managersecret-managerVerified publisher1.0.01 of 4See more

secret-manager secret-manager 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-27606.

Container imageDigestPackageFixed in
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
rollup@2.79.1
2.80.0

Open the chart page →

5,497
sneakerssneakers1.0.01 of 4See more

sneakers sneakers 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-27606.

Container imageDigestPackageFixed in
helga09/shoes_ukr:v1.1.17999bc8b77c0
rollup@2.79.1
2.80.0

Open the chart page →

7,574
lodestar-validatorstakewise1.2.01 of 1See more

lodestar-validator stakewise 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-27606.

Container imageDigestPackageFixed in
chainsafe/lodestar:v1.27.07b9fe4aa8073
rollup@4.22.4
4.59.0

Open the chart page →

4,052
slack-emoji-makersuminhong0.1.01 of 1See more

slack-emoji-maker suminhong 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-27606.

Container imageDigestPackageFixed in
honglab/slack-emoji-maker:v0.0.1ca075a926fe1
rollup@3.29.5
3.30.0

Open the chart page →

1,653
codegentest-opea1.0.01 of 5See more

codegen test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-27606.

Container imageDigestPackageFixed in
opea/codegen-ui:1.02bee4eb66f3e
rollup@3.29.4
3.30.0

Open the chart page →

28,814
codetranstest-opea1.0.01 of 5See more

codetrans test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-27606.

Container imageDigestPackageFixed in
opea/codetrans-ui:1.03ef121f34610
rollup@4.22.0
4.59.0

Open the chart page →

28,385
docsumtest-opea1.0.01 of 5See more

docsum test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-27606.

Container imageDigestPackageFixed in
opea/docsum-ui:1.07f854e9bffaf
rollup@4.22.0
4.59.0

Open the chart page →

28,858
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-27606.

Container imageDigestPackageFixed in
samajh/alprfrontend:latest05ef4fddbb75
rollup@1.32.1
2.80.0

Open the chart page →

20,270
kenerunxwaresVerified publisher2026.2.51 of 1See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-27606.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
rollup@3.29.5
3.30.0

Open the chart page →

5,228
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-27606.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
rollup@4.53.3
4.59.0

Open the chart page →

3,746
websitewaldo-visionVerified publisher0.33.01 of 2See more

website waldo-vision 0.33.0

1 of the 2 container images this version deploys carry CVE-2026-27606.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
rollup@2.78.0
2.80.0

Open the chart page →

3,474
workadventureworkadventure1.1.01 of 9See more

workadventure workadventure 1.1.0

1 of the 9 container images this version deploys carry CVE-2026-27606.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
rollup@2.79.1
2.80.0

Open the chart page →

16,083

Container images carrying it

64 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
rollup@2.78.0
2.80.0
3
outlinewiki/outline:0.69.1d060dcd8f9aa
rollup@3.14.0
3.30.0
2
rajnandan1/kener:3.2.1930407afca731
rollup@3.29.5
3.30.0
2
0hlov3/semaphore:v1.0.050f874ec096b
rollup@2.79.1
2.80.0
1
anamskenneth/recipe_frontend:2025-06-079ecf04f42cc3
rollup@4.21.2
4.59.0
1
arfath29/3-tier-app-frontend:latest384b3e377f47
rollup@1.32.1
2.80.0
1
assistiot/open_api_frontend:1.0.1f11d82defc70
rollup@2.79.1
2.80.0
1
automatischio/automatisch:0.15.03bace7a12d5f
rollup@4.40.1
4.59.0
1
ccjacobs14/amazon:59a9b14a6f09e
rollup@2.79.1
2.80.0
1
chainsafe/lodestar:latest5593f6e97912
rollup@4.52.5
4.59.0
1
chainsafe/lodestar:v1.27.07b9fe4aa8073
rollup@4.22.4
4.59.0
1
coldatom/containers-security-front:latest7c2fbbb41bcf
rollup@2.79.1
2.80.0
1
conduction/conduction-ui-app:devd591f5e6f2a9
rollup@1.32.1
2.80.0
1
dessalines/lemmy-ui:0.19.20ee4c620d8e93
rollup@2.79.1
2.80.0
1
directus/directus:11.1.0e3c8bb975350
rollup@4.17.2
4.59.0
1
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
rollup@3.12.0
3.30.0
1
evoapicloud/evolution-api:latest966625532d90
rollup@4.53.3
4.59.0
1
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
rollup@2.79.1
2.80.0
1
helga09/shoes_ukr:v1.1.17999bc8b77c0
rollup@2.79.1
2.80.0
1
honglab/slack-emoji-maker:v0.0.1ca075a926fe1
rollup@3.29.5
3.30.0
1
joplin/server:3.0-beta52af57880c0e
rollup@4.2.0
4.59.0
1
joplin/server:2.14.2-betab87564ef34e9
rollup@0.50.1
2.80.0
1
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
rollup@2.79.1
2.80.0
1
mitchxxx/amazon:214e72480ec63a
rollup@2.79.1
2.80.0
1
moonrailgun/tianji:1.11.2b528c8f8fcc4
rollup@4.9.5
4.59.0
1
ooghenekaro/amazon:latest03394ba1d6d8
rollup@2.79.1
2.80.0
1
opea/codegen-ui:1.02bee4eb66f3e
rollup@3.29.4
3.30.0
1
opea/codetrans-ui:1.03ef121f34610
rollup@4.22.0
4.59.0
1
opea/docsum-ui:1.07f854e9bffaf
rollup@4.22.0
4.59.0
1
openbas/caldera-server:5.1.0a277796d9724
rollup@2.71.1
2.80.0
1
openmined/syft-frontend:0.9.5d11524a3854a
rollup@3.29.4
3.30.0
1
outlinewiki/outline:0.82.0494dfb9249a6
rollup@4.5.1
4.59.0
1
samajh/alprfrontend:latest05ef4fddbb75
rollup@1.32.1
2.80.0
1
sharanalwar/redchef-frontend:latest5e82950b16b7
rollup@4.40.0
4.59.0
1
supabase/studio:20241021-9f9b08326d8070c55e9
rollup@3.29.5
3.30.0
1
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
rollup@2.79.1
2.80.0
1
thmmniii/fbs-qcm-frontend:v1.27.1a347f7f4d144
rollup@2.79.2
2.80.0
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
rollup@2.79.2
2.80.0
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
rollup@1.32.1
2.80.0
1
vlebediantsev/notes-admin-front:latest007c6670ff48
rollup@2.79.1
2.80.0
1
vlebediantsev/notes-project-front:latest945675fd2636
rollup@2.79.1
2.80.0
1
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
rollup@2.79.1
2.80.0
1
winfred008/amazon:910a68de5b398
rollup@2.79.1
2.80.0
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
rollup@4.12.0
4.59.0
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
rollup@4.27.4
4.59.0
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
rollup@4.44.0
4.59.0
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
rollup@4.44.0
4.59.0
1
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
rollup@4.32.1
4.59.0
1
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
rollup@4.21.2
4.59.0
1
ghcr.io/manzil-infinity180/frontend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b44e6394b715d9
rollup@4.24.0
4.59.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.