StackRadar

CVE-2026-39822

Unscored

Advisory

Published 7 Jul 2026In the index since 5 Sept 2026
Severity
Unscored
worst across findings
CVSS
—
base score, highest
EPSS
0.002
7th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,503
of 17,939 indexed, latest versions
Container images
5,117
deployed by those charts
Fix available
1 of 1
affected package

Root escape via symlink plus trailing slash in os

Carried by container images the latest versions of 4,503 of 17,939 indexed charts deploy, on 5,117 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+191 more1.25.125,117
OSV records
GO-2026-4970
Also known as
BIT-golang-2026-39822

Charts affected

4,503 by stars
ChartLatestAffected imagesRadar Score
cloudflare-tunnelportefaix-hub0.4.01 of 1See more

cloudflare-tunnel portefaix-hub 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
cloudflare/cloudflared:2024.8.314d9c6b01b29
stdlib@go1.22.2-devel-cf
1.25.12

Open the chart page →

1,349
podtato-headportefaix-hub0.3.06 of 6See more

podtato-head portefaix-hub 0.3.0

6 of the 6 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/podtato-head/entry:latestc3d9d9c98be7
stdlib@go1.19
1.25.12
ghcr.io/podtato-head/hat:latestde37ff39a4c0
stdlib@go1.19
1.25.12
ghcr.io/podtato-head/left-arm:latest97596c95276a
stdlib@go1.19
1.25.12
ghcr.io/podtato-head/left-leg:latest00bb31622b1e
stdlib@go1.19
1.25.12
ghcr.io/podtato-head/right-arm:latest5f8f97a60558
stdlib@go1.19
1.25.12
ghcr.io/podtato-head/right-leg:latest03e125b9279e
stdlib@go1.19
1.25.12

Open the chart page →

5,291
prometheus-bbox-exporterportefaix-hub0.4.11 of 1See more

prometheus-bbox-exporter portefaix-hub 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/nlamirault/bbox_exporter:1.0.0f5dd1f7794c6
stdlib@go1.18.3
1.25.12

Open the chart page →

2,008
prometheus-freebox-exporterportefaix-hub0.1.11 of 1See more

prometheus-freebox-exporter portefaix-hub 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/nlamirault/freebox-exporter:1.0.02d522b664e12
stdlib@go1.19.2
1.25.12

Open the chart page →

1,750
speedtest-exporterportefaix-hub0.5.01 of 1See more

speedtest-exporter portefaix-hub 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/danopstech/speedtest_exporter:v0.0.599efbe55412b
stdlib@go1.16.6
1.25.12

Open the chart page →

1,211
unifi-pollerportefaix-hub0.1.01 of 1See more

unifi-poller portefaix-hub 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
golift/unifi-poller:v2.9.5486a63339969
stdlib@go1.21.5
1.25.12

Open the chart page →

970
postgrespostgresVerified publisher0.1.11 of 1See more

postgres postgres 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/postgres:13.12ced3ba927f4c
stdlib@go1.18.2
1.25.12

Open the chart page →

5,106
svc-postgrespostgres-fiap-lanches0.1.01 of 1See more

svc-postgres postgres-fiap-lanches 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/postgres:latest86c951e05bf5
stdlib@go1.24.6
1.25.12

Open the chart page →

1,320
liftbridgepozetron0.1.11 of 1See more

liftbridge pozetron 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
pozetroninc/liftbridge:v1.1.079fd6b9d93e6
stdlib@go1.13.12
1.25.12

Open the chart page →

3,173
Practica_4_helmpr04helm0.1.03 of 7See more

Practica_4_helm pr04helm 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.09fb4c11e6a49
stdlib@go1.18.10
1.25.12
library/mongo:5.0.6-focal8e70544b6c76
stdlib@go1.16.7
1.25.12
library/mysql:8.0.28fc77d54cacef
stdlib@go1.16.7
1.25.12

Open the chart page →

28,578
practica-helmpractica-helm0.1.03 of 7See more

practica-helm practica-helm 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/mongo:4.4-bionic3d0e6df9fd5b
stdlib@go1.16.3
1.25.12
library/mysql:5.74bc6bc963e6d
stdlib@go1.18.2
1.25.12
slagattollas/weatherservice-practica:latest68e7f56393fc
stdlib@go1.15.6
1.25.12

Open the chart page →

29,211
pagesprasanthi1.0.01 of 3See more

pages prasanthi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.25.12

Open the chart page →

20,574
cloudwatch-exporterpresto-loadbalancer0.0.61 of 1See more

cloudwatch-exporter presto-loadbalancer 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
garugaru/aws-cloudwatch-exporter:latest541852cafda5
stdlib@go1.16.15
1.25.12

Open the chart page →

1,088
hive-metastorepresto-loadbalancer0.2.31 of 1See more

hive-metastore presto-loadbalancer 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
datappeal/hive-metastore:lateste38c085a3567
stdlib@go1.13.4
1.25.12

Open the chart page →

9,635
oauth2-proxypresto-loadbalancer4.3.181 of 2See more

oauth2-proxy presto-loadbalancer 4.3.18

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
quay.io/oauth2-proxy/oauth2-proxy:v6.1.1791aef35b8d1
stdlib@go1.14.4
1.25.12

Open the chart page →

3,961
presto-exporterpresto-loadbalancer0.0.91 of 1See more

presto-exporter presto-loadbalancer 0.0.9

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
garugaru/presto-exporter:cb666560e9e82d5ae36aef1e663c3d7f51cca9fc5201314c28f3
stdlib@go1.14.13
1.25.12

Open the chart page →

2,186
presto-loadbalancerpresto-loadbalancer0.1.161 of 1See more

presto-loadbalancer presto-loadbalancer 0.1.16

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
garugaru/presto-loadbalancer:v0.1.589d66d117029
stdlib@go1.15.2
1.25.12

Open the chart page →

2,519
rds-exporterpresto-loadbalancer0.0.21 of 1See more

rds-exporter presto-loadbalancer 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
garugaru/aws-cloudwatch-exporter:latest541852cafda5
stdlib@go1.16.15
1.25.12

Open the chart page →

1,088
trinopresto-loadbalancer0.2.101 of 2See more

trino presto-loadbalancer 0.2.10

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
trinodb/trino:4796af989b0846d
stdlib@go1.25.4
1.25.12

Open the chart page →

2,415
trino-exporterpresto-loadbalancer0.0.121 of 1See more

trino-exporter presto-loadbalancer 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
datappeal/trino-exporter:latest325b91c2b09e
stdlib@go1.16.15
1.25.12

Open the chart page →

1,964
trino-loadbalancerpresto-loadbalancer0.3.11 of 1See more

trino-loadbalancer presto-loadbalancer 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
datappeal/trino-loadbalancer:sha-950abbae6b5b9fdb2e6d
stdlib@go1.17.13
1.25.12

Open the chart page →

2,387
priceapp-chartpriceapp0.1.01 of 1See more

priceapp-chart priceapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ildarmukhametzyanov/priceapp:0.115d23720a3ee
stdlib@go1.21.1
1.25.12

Open the chart page →

8,464
primeprime1.0.01 of 1See more

prime prime 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
udhos/prime:1.0.0e432012dd34a
stdlib@go1.20.4
1.25.12

Open the chart page →

1,687
prismeai-appsprismeai0.7.11 of 4See more

prismeai-apps prismeai 0.7.1

1 of the 4 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
stdlib@go1.24.11
1.25.12

Open the chart page →

2,876
prismeai-coreprismeai1.12.31 of 7See more

prismeai-core prismeai 1.12.3

1 of the 7 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
stdlib@go1.24.11
1.25.12

Open the chart page →

3,952
procestypecatalogusprocestypecatalogus1.1.01 of 4See more

procestypecatalogus procestypecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/procestypecatalogus-php:latest956c4fb64796
stdlib@go1.13.10
1.25.12

Open the chart page →

7,485
productenendienstencatalogusproductenendienstencatalogus1.0.01 of 3See more

productenendienstencatalogus productenendienstencatalogus 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/productenendienstencatalogus-php:latest7242da105081
stdlib@go1.13.10
1.25.12

Open the chart page →

7,565
capsule-addon-fluxcdprojectcapsuleVerified publisher0.2.01 of 1See more

capsule-addon-fluxcd projectcapsule 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/projectcapsule/capsule-addon-fluxcd:0.2.2e0baf564b706
stdlib@go1.23.4
1.25.12

Open the chart page →

564
capsule-proxyprojectcapsuleOfficialVerified publisher0.14.12 of 2See more

capsule-proxy projectcapsule 0.14.1

2 of the 2 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
clastix/kubectl:v1.3122918a06c253
stdlib@go1.22.5
1.25.12
ghcr.io/projectcapsule/capsule-proxy:v0.14.17c90292e3172
stdlib@go1.26.4
1.25.12

Open the chart page →

1,273
wp-chartprojet-devops0.1.01 of 2See more

wp-chart projet-devops 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
stdlib@go1.18.2
1.25.12

Open the chart page →

4,659
prometheus-artifactory-exporterprometheus-artifactory-exporter0.9.21 of 1See more

prometheus-artifactory-exporter prometheus-artifactory-exporter 0.9.2

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/peimanja/artifactory_exporter:v1.16.0d3e3929a3d2b
stdlib@go1.21.13
1.25.12

Open the chart page →

422
jiralertprometheus-communityVerified publisher1.9.01 of 1See more

jiralert prometheus-community 1.9.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
quay.io/jiralert/jiralert-linux-amd64:v1.3.01983aa64761a
stdlib@go1.19.6
1.25.12

Open the chart page →

729
prometheus-couchdb-exporterprometheus-communityVerified publisher1.1.01 of 1See more

prometheus-couchdb-exporter prometheus-community 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
gesellix/couchdb-prometheus-exporter:v286266d063f5d5
stdlib@go1.13.13
1.25.12

Open the chart page →

1,302
prometheus-modbus-exporterprometheus-communityVerified publisher0.1.41 of 1See more

prometheus-modbus-exporter prometheus-community 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
openenergyprojects/modbus_exporter:20230617_a14455158990f24fb25
stdlib@go1.20.5
1.25.12

Open the chart page →

1,204
yet-another-cloudwatch-exporterprometheus-communityVerified publisher0.39.11 of 1See more

yet-another-cloudwatch-exporter prometheus-community 0.39.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
quay.io/prometheuscommunity/yet-another-cloudwatch-exporter:v0.62.1bdba5215a666
stdlib@go1.23.4
1.25.12

Open the chart page →

394
prometheus-optimizerprometheus-optimizer0.2.221 of 1See more

prometheus-optimizer prometheus-optimizer 0.2.22

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/angelscloud/prometheus-optimizer:latest744bc929a579
stdlib@go1.21.4
1.25.12

Open the chart page →

4,621
alertmanagerprometheus-worawutchan0.3.01 of 1See more

alertmanager prometheus-worawutchan 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
quay.io/prometheus/alertmanager:v0.21.024a5204b418e
stdlib@go1.14.4
1.25.12

Open the chart page →

2,300
prometheus-blackbox-exporterprometheus-worawutchan4.10.11 of 1See more

prometheus-blackbox-exporter prometheus-worawutchan 4.10.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
prom/blackbox-exporter:v0.18.01ffc3f109eb3
stdlib@go1.15.2
1.25.12

Open the chart page →

2,245
prometheus-druid-exporterprometheus-worawutchan0.9.01 of 1See more

prometheus-druid-exporter prometheus-worawutchan 0.9.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
quay.io/opstree/druid-exporter:v0.83f6d9885cfe2
stdlib@go1.14.6
1.25.12

Open the chart page →

2,092
prometheus-node-exporterprometheus-worawutchan1.12.01 of 1See more

prometheus-node-exporter prometheus-worawutchan 1.12.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
quay.io/prometheus/node-exporter:v1.0.1cf66a6bbd573
stdlib@go1.14.4
1.25.12

Open the chart page →

2,183
prometheus-pushgatewayprometheus-worawutchan1.5.01 of 1See more

prometheus-pushgateway prometheus-worawutchan 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
prom/pushgateway:v1.3.0c0d39b8d4cfe
stdlib@go1.15.2
1.25.12

Open the chart page →

1,287
prometheus-redis-exporterprometheus-worawutchan4.0.01 of 1See more

prometheus-redis-exporter prometheus-worawutchan 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
oliver006/redis_exporter:v1.11.104d958d209ab
stdlib@go1.15
1.25.12

Open the chart page →

1,317
prometheus-statsd-exporterprometheus-worawutchan0.1.01 of 1See more

prometheus-statsd-exporter prometheus-worawutchan 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
prom/statsd-exporter:v0.18.0d23aca343b86
stdlib@go1.14.7
1.25.12

Open the chart page →

1,317
prompt-dbprompt-dbVerified publisher1.0.71 of 3See more

prompt-db prompt-db 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
stdlib@go1.24.6
1.25.12

Open the chart page →

3,506
panproto-application-nldesign0.1.01 of 5See more

pan proto-application-nldesign 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
conduction/pan-php:dev24f03c57568f
stdlib@go1.13.10
1.25.12

Open the chart page →

8,991
proto-component-commongroundproto-component-commonground1.0.01 of 3See more

proto-component-commonground proto-component-commonground 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/proto-component-commonground-php:latesteb36ead1954e
stdlib@go1.13.10
1.25.12

Open the chart page →

7,565
flaskDiaryptj-miniproject2.1.21 of 2See more

flaskDiary ptj-miniproject 2.1.2

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.25.12

Open the chart page →

3,262
kspanpuckpuck0.2.41 of 1See more

kspan puckpuck 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/honeycombio/kspan/kspan:0.2c966a4f8a4b7
stdlib@go1.20.1
1.25.12

Open the chart page →

1,687
powerdnspuckpuck2.0.03 of 4See more

powerdns puckpuck 2.0.0

3 of the 4 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
library/postgres:18-alpine77f585114c32
stdlib@go1.24.6
1.25.12
pschiffe/pdns-admin:0.4.137ebba8c2b8f
stdlib@go1.21.5
1.25.12
pschiffe/pdns-pgsql:5.0a227d41bc665
stdlib@go1.21.5
1.25.12

Open the chart page →

4,294
seashellpuckpuck1.2.01 of 1See more

seashell puckpuck 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container imageDigestPackageFixed in
ghcr.io/puckpuck/seashell:1.2ef5e31333821
stdlib@go1.20.10
1.25.12

Open the chart page →

4,231

Container images carrying it

5,117 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/csi-snapshotter:v8.2.15f4bb469fec5
stdlib@go1.23.6
1.25.12
1
registry.k8s.io/sig-storage/csi-snapshotter:v4.2.1818f35653f2e
stdlib@go1.16.2
1.25.12
1
registry.k8s.io/sig-storage/csi-snapshotter:v5.0.189e900a160a9
stdlib@go1.17.3
1.25.12
1
registry.k8s.io/sig-storage/hostpathplugin:v1.9.092257881c1d6
stdlib@go1.18
1.25.12
1
registry.k8s.io/sig-storage/livenessprobe:v2.9.02b10b24dafdc
stdlib@go1.19
1.25.12
1
registry.k8s.io/sig-storage/livenessprobe:v2.11.082adbebdf5d5
stdlib@go1.20.5
1.25.12
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
stdlib@go1.23.4
1.25.12
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.9.0f9d65db8bda2
stdlib@go1.25.5
1.25.12
1
registry.k8s.io/sig-storage/nfsplugin:v4.13.41eb5a85180a4
stdlib@go1.26.4
1.25.12
1
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
stdlib@go1.23.6
1.25.12
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
stdlib@go1.15
1.25.12
1
registry.k8s.io/sig-storage/objectstorage-sidecar:v0.2.2c7166a73a303
stdlib@go1.24.11
1.25.12
1
registry.k8s.io/sig-storage/snapshot-controller:v8.2.1472fa35a89da
stdlib@go1.23.6
1.25.12
1
registry.k8s.io/sig-storage/snapshot-controller:v4.2.195587f8777d7
stdlib@go1.16.2
1.25.12
1
registry.k8s.io/sig-storage/snapshot-controller:v6.2.198bab4eaf23c
stdlib@go1.19
1.25.12
1
registry.k8s.io/sig-storage/snapshot-controller:v6.3.1ce6ca3c0e30b
stdlib@go1.20.5
1.25.12
1
registry.k8s.io/sig-storage/volume-data-source-validator:v1.0.0d35884236461
stdlib@go1.17.3
1.25.12
1

syft 1.42.1 · advisories as of 29 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.