StackRadar

CVE-2026-44973

High

Advisory

Published 14 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.1
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
167
of 17,781 indexed, latest versions
Container images
176
deployed by those charts
Fix available
2 of 2
affected packages

go-billy has path traversal vulnerabilities

Carried by container images the latest versions of 167 of 17,781 indexed charts deploy, on 176 images.

Affected packageAffected versionsFixed inImages
github.com/go-git/go-billy/v5golangv5.0.0, v5.1.0, v5.3.1, v5.4.0+7 more5.9.0175
github.com/go-git/go-billy/v6golangv6.0.0-20250711053805-c1f149aaab076.0.0-alpha.11
OSV records
GHSA-qw64-3x98-g7q2
Also known as
GO-2026-5597

Charts affected

167 by stars
ChartLatestAffected imagesRadar Score
sn-platform-slimstreamnative1.11.441 of 6See more

sn-platform-slim streamnative 1.11.44

1 of the 6 container images this version deploys carry CVE-2026-44973.

Container imageDigestPackageFixed in
streamnative/apache-pulsar-grafana-dashboard-k8s:0.1.20e6d7aa3ef32
github.com/go-git/go-billy/v5@v5.3.1
5.9.0

Open the chart page →

10,134
grafanasvtech-public-helm-charts1.0.01 of 2See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-44973.

Container imageDigestPackageFixed in
svtechnmaa/svtech_grafana:v1.2.21d71314424aa
github.com/go-git/go-billy/v5@v5.3.1
5.9.0

Open the chart page →

10,902
switchbladeswitchblade0.0.191 of 1See more

switchblade switchblade 0.0.19

1 of the 1 container images this version deploys carry CVE-2026-44973.

Container imageDigestPackageFixed in
public.ecr.aws/boundless-software/switchblade:release-v0.0.19-lcm01d8413d5075
github.com/go-git/go-billy/v5@v5.5.0
5.9.0

Open the chart page →

1,360
agentssynapse0.1.303 of 9See more

agents synapse 0.1.30

3 of the 9 container images this version deploys carry CVE-2026-44973.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/agents:6e3887fc2a05aff0d159453cedbfbe5024b910bf81a9ebc899a4
github.com/go-git/go-billy/v5@v5.4.0
5.9.0
ghcr.io/synapsecns/sanguine/omnirpc:latest5217e3d1fc70
github.com/go-git/go-billy/v5@v5.5.0
5.9.0
ghcr.io/synapsecns/sanguine/scribe:6e3887fc2a05aff0d159453cedbfbe5024b910bf5e0a3dfa9f96
github.com/go-git/go-billy/v5@v5.4.0
5.9.0

Open the chart page →

7,244
cctpsynapse0.3.01 of 4See more

cctp synapse 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-44973.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/cctp-relayer:b5a1dd5288f1a18eb05994e130d626fed45a56fc2f1408c94168
github.com/go-git/go-billy/v5@v5.4.0
5.9.0

Open the chart page →

1,815
explorersynapse0.2.162 of 6See more

explorer synapse 0.2.16

2 of the 6 container images this version deploys carry CVE-2026-44973.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/explorer:latest00131e3d1eaf
github.com/go-git/go-billy/v5@v5.5.0
5.9.0
ghcr.io/synapsecns/sanguine/omnirpc:latest5217e3d1fc70
github.com/go-git/go-billy/v5@v5.5.0
5.9.0

Open the chart page →

8,518
omnirpcsynapse0.2.921 of 2See more

omnirpc synapse 0.2.92

1 of the 2 container images this version deploys carry CVE-2026-44973.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/omnirpc:latest5217e3d1fc70
github.com/go-git/go-billy/v5@v5.5.0
5.9.0

Open the chart page →

1,121
promexportersynapse0.1.11 of 1See more

promexporter synapse 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-44973.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/promexporter:4a9aad096c2bd1160e56e5472ddac77fa0cde2e9416c1c5aeb86
github.com/go-git/go-billy/v5@v5.4.0
5.9.0

Open the chart page →

1,704
screenersynapse0.2.51 of 4See more

screener synapse 0.2.5

1 of the 4 container images this version deploys carry CVE-2026-44973.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/screener-api:latestb3de2050460a
github.com/go-git/go-billy/v5@v5.5.0
5.9.0

Open the chart page →

1,091
scribesynapse0.2.162 of 7See more

scribe synapse 0.2.16

2 of the 7 container images this version deploys carry CVE-2026-44973.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/omnirpc:latest5217e3d1fc70
github.com/go-git/go-billy/v5@v5.5.0
5.9.0
ghcr.io/synapsecns/sanguine/scribe:latest81edba952403
github.com/go-git/go-billy/v5@v5.5.0
5.9.0

Open the chart page →

2,680
sinnersynapse0.1.01 of 6See more

sinner synapse 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-44973.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/sinner:latest3e98a98f6074
github.com/go-git/go-billy/v5@v5.5.0
5.9.0

Open the chart page →

1,955
act-runnertektonops0.1.21 of 2See more

act-runner tektonops 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-44973.

Container imageDigestPackageFixed in
gitea/act_runner:nightly7940221bcfc9
github.com/go-git/go-billy/v5@v5.8.0
5.9.0

Open the chart page →

4,212
owncloudth-chartsVerified publisher0.2.11 of 1See more

owncloud th-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-44973.

Container imageDigestPackageFixed in
owncloud/server:10.15.051d9b74fc2a8
github.com/go-git/go-billy/v5@v5.5.0
5.9.0

Open the chart page →

10,006
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-44973.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
github.com/go-git/go-billy/v5@v5.5.0
5.9.0

Open the chart page →

2,477
tfy-agenttruefoundryVerified publisher0.2.1031 of 5See more

tfy-agent truefoundry 0.2.103

1 of the 5 container images this version deploys carry CVE-2026-44973.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/external-secrets:v2.4.19440a40b3947
github.com/go-git/go-billy/v5@v5.8.0
5.9.0

Open the chart page →

681
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-44973.

Container imageDigestPackageFixed in
opencloudeu/opencloud-rolling:2.1.0f9634bb04905
github.com/go-git/go-billy/v5@v5.6.2
5.9.0

Open the chart page →

45,239
argo-eventswenerme2.4.271 of 1See more

argo-events wenerme 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-44973.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
github.com/go-git/go-billy/v5@v5.6.2
5.9.0

Open the chart page →

969

Container images carrying it

176 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/devtron/dex:v2.30.22e4c14d1b444
github.com/go-git/go-billy/v5@v5.0.0
5.9.0
6
quay.io/devtron/kubectl:latest2ad610626658
github.com/go-git/go-billy/v5@v5.3.1
5.9.0
6
ghcr.io/synapsecns/sanguine/omnirpc:latest5217e3d1fc70
github.com/go-git/go-billy/v5@v5.5.0
5.9.0
4
ghcr.io/dexidp/dex:v2.45.18499afd690c4
github.com/go-git/go-billy/v5@v5.7.0
5.9.0
3
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/go-git/go-billy/v5@v5.6.2
5.9.0
3
quay.io/devtron/git-sensor:94237c18-950-3941803c7bf249aa1
github.com/go-git/go-billy/v5@v5.6.2
5.9.0
3
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/go-git/go-billy/v5@v5.6.2
5.9.0
3
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/go-git/go-billy/v5@v5.4.1
5.9.0
3
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
github.com/go-git/go-billy/v5@v5.6.2
5.9.0
3
quay.io/devtron/kubewatch:49f906a5-419-14814eec0305b594c
github.com/go-git/go-billy/v5@v5.4.1
5.9.0
3
grafana/alloy:v1.8.17790f6f7fbd8
github.com/go-git/go-billy/v5@v5.6.0
5.9.0
2
grafana/alloy:v1.12.2f94b1c82957a
github.com/go-git/go-billy/v5@v5.6.2
5.9.0
2
grafana/grafana:9.2.4057896e23443
github.com/go-git/go-billy/v5@v5.3.1
5.9.0
2
mesosphere/kubeaddons-catalog:v0.11.4073db43d0b8b
github.com/go-git/go-billy/v5@v5.0.0
5.9.0
2
opencloudeu/opencloud-rolling:2.1.0f9634bb04905
github.com/go-git/go-billy/v5@v5.6.2
5.9.0
2
rclone/rclone:1.6874c51b8817e5
github.com/go-git/go-billy/v5@v5.5.0
5.9.0
2
streamnative/apache-pulsar-grafana-dashboard-k8s:0.1.20e6d7aa3ef32
github.com/go-git/go-billy/v5@v5.3.1
5.9.0
2
ghcr.io/dexidp/dex:v2.28.15e88f2205de1
github.com/go-git/go-billy/v5@v5.0.0
5.9.0
2
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/go-git/go-billy/v5@v5.6.2
5.9.0
2
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
github.com/go-git/go-billy/v5@v5.6.2
5.9.0
2
quay.io/groundcover/grafana:9.3.18c65b333a3d3
github.com/go-git/go-billy/v5@v5.3.1
5.9.0
2
abohatyrenko/bucket-backup-restore:latestfa98af15a13e
github.com/go-git/go-billy/v5@v5.5.0
5.9.0
1
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
github.com/go-git/go-billy/v5@v5.6.0
5.9.0
1
aquasec/harbor-scanner-trivy:0.31.26e790e233872
github.com/go-git/go-billy/v5@v5.5.0
5.9.0
1
aquasec/harbor-scanner-trivy:0.20.07ea4aa3d2eb6
github.com/go-git/go-billy/v5@v5.0.0
5.9.0
1
aquasec/trivy:0.43.1944a04445179
github.com/go-git/go-billy/v5@v5.4.1
5.9.0
1
aquasec/trivy:0.32.0973d0df16189
github.com/go-git/go-billy/v5@v5.3.1
5.9.0
1
aquasec/trivy:0.69.3bcc376de8d77
github.com/go-git/go-billy/v5@v5.6.2
5.9.0
1
artifacthub/hub:v1.19.0111918d8c399
github.com/go-git/go-billy/v5@v5.5.0
5.9.0
1
artifacthub/scanner:v1.23.02d8365601f0e
github.com/go-git/go-billy/v5@v5.6.2
5.9.0
1
artifacthub/scanner:v1.19.0323d026e78c3
github.com/go-git/go-billy/v5@v5.5.0
5.9.0
1
artifacthub/tracker:v1.23.05368d21a6e5c
github.com/go-git/go-billy/v5@v5.6.2
5.9.0
1
artifacthub/tracker:v1.19.06596c8c4d955
github.com/go-git/go-billy/v5@v5.5.0
5.9.0
1
bluenviron/mediamtx:1.17.19e39256d1ba3
github.com/go-git/go-billy/v5@v5.8.0
5.9.0
1
buddyspencer/gickup:0.10.386b656f19b0c1
github.com/go-git/go-billy/v5@v5.6.2
5.9.0
1
buddyspencer/gickup:0.10.309e7dbf923c12
github.com/go-git/go-billy/v5@v5.5.0
5.9.0
1
casbin/casdoor:v1.753.0770ad9ec3190
github.com/go-git/go-billy/v5@v5.5.0
5.9.0
1
casbin/casdoor:3.62.17729da148c61
github.com/go-git/go-billy/v5@v5.6.2
5.9.0
1
casbin/casdoor:3.62.0e08231f16c00
github.com/go-git/go-billy/v5@v5.6.2
5.9.0
1
chaosnative/cle-server:2.7.0e7bcff4a20c0
github.com/go-git/go-billy/v5@v5.1.0
5.9.0
1
charmcli/soft-serve:v0.4.039523c1a6ba8
github.com/go-git/go-billy/v5@v5.3.1
5.9.0
1
datadog/agent:6aad9994de6a7
github.com/go-git/go-billy/v5@v5.6.0
5.9.0
1
datawire/aes:3.11.195ec30b3c732
github.com/go-git/go-billy/v5@v5.5.0
5.9.0
1
devopstales/trivy-operator:2.575136aa7a26e
github.com/go-git/go-billy/v5@v5.3.1
5.9.0
1
dexidp/dex:v2.39.1-distroless43655afd1a8f
github.com/go-git/go-billy/v5@v5.5.0
5.9.0
1
epamedp/codebase-operator:2.12.0-MDTU-DDM-SNAPSHOT.1096028c86f0dd
github.com/go-git/go-billy/v5@v5.3.1
5.9.0
1
epamedp/gerrit-operator:2.11.0-MDTU-DDM-SNAPSHOT.2b71fb39e0c9e
github.com/go-git/go-billy/v5@v5.3.1
5.9.0
1
epamedp/reconciler:2.12.0d33e938b6d59
github.com/go-git/go-billy/v5@v5.3.1
5.9.0
1
flanksource/apm-hub:v0.0.471dacc3195bf9
github.com/go-git/go-billy/v5@v5.4.1
5.9.0
1
flanksource/batch-runner:v1.0.44689687a7cf95
github.com/go-git/go-billy/v5@v5.6.2
5.9.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.