StackRadar

CVE-2026-39822

Unscored

Advisory

Published 7 Jul 2026In the index since 5 Sept 2026
Severity
Unscored
worst across findings
CVSS
—
base score, highest
EPSS
0.002
7th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,503
of 17,939 indexed, latest versions
Container images
5,117
deployed by those charts
Fix available
1 of 1
affected package

Root escape via symlink plus trailing slash in os

Carried by container images the latest versions of 4,503 of 17,939 indexed charts deploy, on 5,117 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+191 more1.25.125,117
OSV records
GO-2026-4970
Also known as
BIT-golang-2026-39822

Charts affected

4,503 by stars
ChartLatestAffected imagesRadar Score
mongodb-secure-backupmongodb-secure-backup1.0.01 of 2See more

mongodb-secure-backup mongodb-secure-backup 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
arconixforge/mongodb-secure-backup:v1.1c08d7c438966
stdlib@go1.22.10
1.25.12

Open the chart page →

1,034
mongopingmongoping1.3.11 of 1See more

mongoping mongoping 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
udhos/mongoping:1.3.103b08b63f524
stdlib@go1.24.2
1.25.12

Open the chart page →

1,309
monitoringmonitoring0.1.01 of 1See more

monitoring monitoring 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
jkaninda/grafana:11.0.08cfda26ecb7d
stdlib@go1.21.10
1.25.12

Open the chart page →

1,931
moodlemoodle1.0.31 of 2See more

moodle moodle 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
cloudtooling/moodle:5.2.3f4f04e0fc401
stdlib@go1.26.4
1.25.12

Open the chart page →

4,328
camera-viewermoreillonVerified publisher0.2.11 of 4See more

camera-viewer moreillon 0.2.1

1 of the 4 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:6.0.4-debian-11-r10016dce036593
stdlib@go1.17.10
1.25.12

Open the chart page →

12,205
face-recognitionmoreillonVerified publisher0.2.41 of 3See more

face-recognition moreillon 0.2.4

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:6.0.4-debian-11-r10016dce036593
stdlib@go1.17.10
1.25.12

Open the chart page →

9,298
mqtt-loggermoreillonVerified publisher0.3.12 of 5See more

mqtt-logger moreillon 0.3.1

2 of the 5 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
bitnamilegacy/influxdb:2.6.1-debian-11-r18d17df1f9d745
stdlib@go1.19.6
1.25.12
bitnamilegacy/mongodb:6.0.4-debian-11-r10016dce036593
stdlib@go1.17.10
1.25.12

Open the chart page →

11,304
user-manager-mongodbmoreillonVerified publisher0.6.21 of 4See more

user-manager-mongodb moreillon 0.6.2

1 of the 4 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:6.0.10-debian-11-r842319decb591
stdlib@go1.19.12
1.25.12

Open the chart page →

26,926
backupmorremeyer4.0.01 of 1See more

backup morremeyer 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
restic/restic:0.15.2579e4e6a4931
stdlib@go1.19.8
1.25.12

Open the chart page →

2,305
hcloud-ccm-networksmorremeyer2.0.01 of 1See more

hcloud-ccm-networks morremeyer 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
hetznercloud/hcloud-cloud-controller-manager:v1.16.08c07e6d7a76c
stdlib@go1.20.5
1.25.12

Open the chart page →

1,753
hcloud-csi-drivermorremeyer3.0.06 of 6See more

hcloud-csi-driver morremeyer 3.0.0

6 of the 6 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
hetznercloud/hcloud-csi-driver:v2.3.2b7ed90d5fab2
stdlib@go1.19.7
1.25.12
registry.k8s.io/sig-storage/csi-attacher:v4.1.008721106b949
stdlib@go1.19
1.25.12
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.7.04a4cae5118c4
stdlib@go1.19
1.25.12
registry.k8s.io/sig-storage/csi-provisioner:v3.4.0e468dddcd275
stdlib@go1.19
1.25.12
registry.k8s.io/sig-storage/csi-resizer:v1.7.03a7bdf5d1057
stdlib@go1.19
1.25.12
registry.k8s.io/sig-storage/livenessprobe:v2.9.02b10b24dafdc
stdlib@go1.19
1.25.12

Open the chart page →

7,239
chirpstackmosquitto-helm-chart0.5.03 of 8See more

chirpstack mosquitto-helm-chart 0.5.0

3 of the 8 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
chirpstack/chirpstack-application-server:3fb7667fe037f
stdlib@go1.19.3
1.25.12
chirpstack/chirpstack-network-server:3c0bbbb7a3f1e
stdlib@go1.19.3
1.25.12
oliver006/redis_exporter:v1.14.0d55e056987af
stdlib@go1.15.6
1.25.12

Open the chart page →

105,079
chirpstack-event-forwardmosquitto-helm-chart0.1.21 of 1See more

chirpstack-event-forward mosquitto-helm-chart 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/liangyuanpeng/chirpstack-event-forward:v0.1.223dc6274cc4b
stdlib@go1.17.10
1.25.12

Open the chart page →

1,849
replacermosquitto-helm-chart0.2.02 of 3See more

replacer mosquitto-helm-chart 0.2.0

2 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/liangyuanpeng/replacer:v1.1.00b2a41c2a43e
stdlib@go1.17.7
1.25.12
ghcr.io/liangyuanpeng/waitfor:v1.0.0ca5a98cbed32
stdlib@go1.17.7
1.25.12

Open the chart page →

3,933
configmapsecretsmozilla0.0.11 of 1See more

configmapsecrets mozilla 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
mzinc/configmapsecret-controller:v0.5.1eebbcbf2d1f7
stdlib@go1.16.1
1.25.12

Open the chart page →

2,104
tianjimsgbyte0.1.171 of 2See more

tianji msgbyte 0.1.17

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
moonrailgun/tianji:1.11.2b528c8f8fcc4
stdlib@go1.20.12
1.25.12

Open the chart page →

4,669
ms-hello-webms-hello-test0.1.01 of 1See more

ms-hello-web ms-hello-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
irakli/ms-web-hello:latest966a4bfefe27
stdlib@go1.19.2
1.25.12

Open the chart page →

756
adguard-homemt1905024.0.121 of 2See more

adguard-home mt190502 4.0.12

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
adguard/adguardhome:v0.107.737fbf01d73ecb
stdlib@go1.25.7
1.25.12

Open the chart page →

1,202
codimdmt1905027.2.21 of 3See more

codimd mt190502 7.2.2

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/postgres:1886c951e05bf5
stdlib@go1.24.6
1.25.12

Open the chart page →

1,320
commafeedmt1905028.2.01 of 3See more

commafeed mt190502 8.2.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/postgres:1886c951e05bf5
stdlib@go1.24.6
1.25.12

Open the chart page →

3,629
ghostmt1905028.25.12 of 3See more

ghost mt190502 8.25.1

2 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
stdlib@go1.24.6
1.25.12
library/mysql:80744ee5ef89c
stdlib@go1.24.6
1.25.12

Open the chart page →

5,250
keycloakmt1905021.4.61 of 3See more

keycloak mt190502 1.4.6

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/postgres:1886c951e05bf5
stdlib@go1.24.6
1.25.12

Open the chart page →

2,773
maddymt1905024.1.21 of 1See more

maddy mt190502 4.1.2

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
foxcpp/maddy:0.9.2a4b839985b9b
stdlib@go1.23.12
1.25.12

Open the chart page →

1,068
memosmt1905027.3.22 of 3See more

memos mt190502 7.3.2

2 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/postgres:1886c951e05bf5
stdlib@go1.24.6
1.25.12
neosmemo/memos:0.26.23eefcc231141
stdlib@go1.25.7
1.25.12

Open the chart page →

2,319
minifluxmt1905021.1.62 of 3See more

miniflux mt190502 1.1.6

2 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/postgres:1886c951e05bf5
stdlib@go1.24.6
1.25.12
miniflux/miniflux:2.2.18a3ca6bbc1f74
stdlib@go1.26.1
1.25.12

Open the chart page →

2,395
nightscoutmt1905021.1.01 of 3See more

nightscout mt190502 1.1.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
stdlib@go1.21.12
1.25.12

Open the chart page →

6,831
open-webuimt1905022.3.101 of 3See more

open-webui mt190502 2.3.10

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/postgres:1886c951e05bf5
stdlib@go1.24.6
1.25.12

Open the chart page →

1,320
paperless-ngxmt1905027.6.142 of 4See more

paperless-ngx mt190502 7.6.14

2 of the 4 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/postgres:1886c951e05bf5
stdlib@go1.24.6
1.25.12
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
stdlib@go1.24.4
1.25.12

Open the chart page →

12,528
umamimt1905028.1.41 of 3See more

umami mt190502 8.1.4

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/postgres:1886c951e05bf5
stdlib@go1.24.6
1.25.12

Open the chart page →

3,732
vaultwardenmt1905027.3.41 of 3See more

vaultwarden mt190502 7.3.4

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/postgres:1886c951e05bf5
stdlib@go1.24.6
1.25.12

Open the chart page →

4,578
vikunjamt1905027.1.22 of 3See more

vikunja mt190502 7.1.2

2 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/postgres:1886c951e05bf5
stdlib@go1.24.6
1.25.12
vikunja/vikunja:0.24.6ed1f3ed467fe
stdlib@go1.23.4
1.25.12

Open the chart page →

2,710
mongodbmulti-chart-app0.1.01 of 1See more

mongodb multi-chart-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/mongo:79854f7139445
stdlib@go1.24.6
1.25.12

Open the chart page →

2,081
my-multi-chart-appmulti-chart-app0.1.01 of 2See more

my-multi-chart-app multi-chart-app 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/mongo:79854f7139445
stdlib@go1.24.6
1.25.12

Open the chart page →

3,767
multusmultusVerified publisher0.2.02 of 2See more

multus multus 0.2.0

2 of the 2 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/k8snetworkplumbingwg/multus-cni:v4.1.409fdfb7ce090
stdlib@go1.23.4
1.25.12
ghcr.io/k8snetworkplumbingwg/multus-dynamic-networks-controller:v0.3.72a2bb32c0ea8
stdlib@go1.22.12
1.25.12

Open the chart page →

1,929
devops-demomungari-development-charts1.0.42 of 4See more

devops-demo mungari-development-charts 1.0.4

2 of the 4 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/postgres:latest86c951e05bf5
stdlib@go1.24.6
1.25.12
ghcr.io/perceptolab/devops-demo-app:0.0.2cdc0658c40fb
stdlib@go1.18.4
1.25.12

Open the chart page →

8,806
pagesmuthu-pages1.0.01 of 3See more

pages muthu-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.25.12

Open the chart page →

20,574
approuvezmvisonneau0.1.11 of 1See more

approuvez mvisonneau 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/mvisonneau/approuvez:v0.1.0441da62e6cb3
stdlib@go1.15.6
1.25.12

Open the chart page →

1,986
unpollermvisonneau0.1.01 of 1See more

unpoller mvisonneau 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
golift/unifi-poller:v2.9.2585a29a06d05
stdlib@go1.21.0
1.25.12

Open the chart page →

1,185
ingress-nginxmxytest4.15.12 of 2See more

ingress-nginx mxytest 4.15.1

2 of the 2 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.15.1594ceea76b01
stdlib@go1.26.1
1.25.12
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.901038e7de14b
stdlib@go1.26.1
1.25.12

Open the chart page →

1,584
danboorumy0nVerified publisher0.0.21 of 1See more

danbooru my0n 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
stdlib@go1.18
1.25.12

Open the chart page →

106,838
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
stdlib@go1.18
1.25.12

Open the chart page →

106,838
authmyaVerified publisher22.4.31 of 1See more

auth mya 22.4.3

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
cesanta/docker_auth:1.6.04d16885f3d4c
stdlib@go1.13.7
1.25.12

Open the chart page →

2,380
clickhousemyaVerified publisher0.2403.11 of 1See more

clickhouse mya 0.2403.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:24.2ed9640bfff07
stdlib@go1.19.10
1.25.12

Open the chart page →

3,740
cognativemyaVerified publisher0.2403.33 of 3See more

cognative mya 0.2403.3

3 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:24.2ed9640bfff07
stdlib@go1.19.10
1.25.12
grafana/grafana:10.4.0f9811e4e687f
stdlib@go1.21.8
1.25.12
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
stdlib@go1.21.7
1.25.12

Open the chart page →

7,535
giteamyaVerified publisher23.12.51 of 1See more

gitea mya 23.12.5

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
gitea/gitea:1.21.6ac73e0da341f
stdlib@go1.21.7
1.25.12

Open the chart page →

3,485
redismyaVerified publisher22.4.101 of 2See more

redis mya 22.4.10

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
quay.io/oliver006/redis_exporter:v1.35.1908dbee5c546
stdlib@go1.17.7
1.25.12

Open the chart page →

1,052
redis-queuemyaVerified publisher22.4.61 of 2See more

redis-queue mya 22.4.6

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
quay.io/oliver006/redis_exporter:v1.35.1908dbee5c546
stdlib@go1.17.7
1.25.12

Open the chart page →

1,052
redis-raftmyaVerified publisher22.5.41 of 2See more

redis-raft mya 22.5.4

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
quay.io/oliver006/redis_exporter:v1.35.1908dbee5c546
stdlib@go1.17.7
1.25.12

Open the chart page →

1,052
myhelmappmyhelmapp0.1.11 of 1See more

myhelmapp myhelmapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
tobirachel/node-project3:v17d9f37154994
stdlib@go1.17.5
1.25.12

Open the chart page →

3,386
my-helm-chartmy-helm-chart0.1.01 of 3See more

my-helm-chart my-helm-chart 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/postgres:latest5a5a84b19854
stdlib@go1.24.6
1.25.12

Open the chart page →

4,086

Container images carrying it

5,117 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/csi-snapshotter:v8.2.15f4bb469fec5
stdlib@go1.23.6
1.25.12
1
registry.k8s.io/sig-storage/csi-snapshotter:v4.2.1818f35653f2e
stdlib@go1.16.2
1.25.12
1
registry.k8s.io/sig-storage/csi-snapshotter:v5.0.189e900a160a9
stdlib@go1.17.3
1.25.12
1
registry.k8s.io/sig-storage/hostpathplugin:v1.9.092257881c1d6
stdlib@go1.18
1.25.12
1
registry.k8s.io/sig-storage/livenessprobe:v2.9.02b10b24dafdc
stdlib@go1.19
1.25.12
1
registry.k8s.io/sig-storage/livenessprobe:v2.11.082adbebdf5d5
stdlib@go1.20.5
1.25.12
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
stdlib@go1.23.4
1.25.12
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.9.0f9d65db8bda2
stdlib@go1.25.5
1.25.12
1
registry.k8s.io/sig-storage/nfsplugin:v4.13.41eb5a85180a4
stdlib@go1.26.4
1.25.12
1
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
stdlib@go1.23.6
1.25.12
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
stdlib@go1.15
1.25.12
1
registry.k8s.io/sig-storage/objectstorage-sidecar:v0.2.2c7166a73a303
stdlib@go1.24.11
1.25.12
1
registry.k8s.io/sig-storage/snapshot-controller:v8.2.1472fa35a89da
stdlib@go1.23.6
1.25.12
1
registry.k8s.io/sig-storage/snapshot-controller:v4.2.195587f8777d7
stdlib@go1.16.2
1.25.12
1
registry.k8s.io/sig-storage/snapshot-controller:v6.2.198bab4eaf23c
stdlib@go1.19
1.25.12
1
registry.k8s.io/sig-storage/snapshot-controller:v6.3.1ce6ca3c0e30b
stdlib@go1.20.5
1.25.12
1
registry.k8s.io/sig-storage/volume-data-source-validator:v1.0.0d35884236461
stdlib@go1.17.3
1.25.12
1

syft 1.42.1 · advisories as of 29 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.