StackRadar

CVE-2026-7774

Medium

Advisory

Published 4 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.006
47th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
119
of 17,781 indexed, latest versions
Container images
110
deployed by those charts
Fix available
8 of 8
affected packages

tarfile.data_filter path traversal bypass allows writing outside the extraction directory

Carried by container images the latest versions of 119 of 17,781 indexed charts deploy, on 110 images.

Affected packageAffected versionsFixed inImages
python3.12deb3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+8 more3.12.3-1ubuntu0.1548
python3.13deb3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+e30, 3.13.7-1ubuntu0.13.13.5-2+deb13u3, 3.13.5-2+e3634
python3apk3.12.12-r0, 3.14.3-r0, 3.14.5-r0, 3.14.5-r13.14.7-r012
python-3.14apk3.14.2-r2, 3.14.4-r2, 3.14.6-r03.14.6-r16
pythonbitnami3.11.11-0, 3.12.8-0, 3.13.5-13.10.213
python-3.13apk3.13.7-r0, 3.13.10-r0, 3.13.12-r23.13.14-r03
python-3.12apk3.12.0-r1, 3.12.9-r13.12.13-r72
python3.14deb3.14.4-13.14.4-1ubuntu0.12
OSV records
ALPINE-CVE-2026-7774BIT-python-2026-7774CGA-2hr7-vw6r-h3gvCGA-56jr-xmq9-2hhwCGA-9mgv-r5gf-82qfDEBIAN-CVE-2026-7774UBUNTU-CVE-2026-7774ECHO-e345-ef13-be4f
Also known as
BIT-libpython-2026-7774, BIT-python-min-2026-7774, CGA-9p8r-m77c-89wx, CGA-h6v3-9x58-7r4w, CGA-rjp8-h8gw-84wj, PSF-2026-26, USN-8509-1

Charts affected

119 by stars
ChartLatestAffected imagesRadar Score
argocd-image-updaterargoOfficialVerified publisher1.3.11 of 1See more

argocd-image-updater argo 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-image-updater:v1.3.0cb009167015c
python3@3.14.5-r0
3.14.7-r0

Open the chart page →

718
zabbixzabbix-communityVerified publisher7.1.01 of 5See more

zabbix zabbix-community 7.1.0

1 of the 5 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
zabbix/zabbix-web-nginx-pgsql:ubuntu-7.0.237d4d58086515
python3.12@3.12.3-1ubuntu0.11
3.12.3-1ubuntu0.15

Open the chart page →

13,664
maildocker-postfixVerified publisher5.1.01 of 1See more

mail docker-postfix 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
boky/postfix:5.1.0aafc77238423
python3.13@3.13.5-2
3.13.5-2+deb13u3

Open the chart page →

5,366
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
python3.12@3.12.3-1ubuntu0.9
3.12.3-1ubuntu0.15

Open the chart page →

19,391
pulsarapache4.7.01 of 10See more

pulsar apache 4.7.0

1 of the 10 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
python3@3.12.12-r0
3.14.7-r0

Open the chart page →

9,864
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:0.6.3-local3c694329357b
python3.12@3.12.3-1ubuntu0.13
3.12.3-1ubuntu0.15

Open the chart page →

22,002
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
python-3.12@3.12.9-r1
3.12.13-r7

Open the chart page →

17,245
meshery-operatormesheryOfficialVerified publisher1.0.691 of 2See more

meshery-operator meshery 1.0.69

1 of the 2 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
alpine/k8s:1.35.6b7a12c5ddf26
python3@3.14.5-r1
3.14.7-r0

Open the chart page →

2,415
jira-softwaremoxVerified publisher2.7.11 of 3See more

jira-software mox 2.7.1

1 of the 3 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
atlassian/jira-software:9.7.264a75aa4ec4e
python3.12@3.12.3-1ubuntu0.5
3.12.3-1ubuntu0.15

Open the chart page →

8,636
passboltpassbolt2.1.11 of 6See more

passbolt passbolt 2.1.1

1 of the 6 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
passbolt/passbolt:5.13.0-1-ceaf3a620902a0
python3.13@3.13.5-2+deb13u2
3.13.5-2+deb13u3

Open the chart page →

13,350
thehivestrangebee-helmOfficialVerified publisher1.0.61 of 7See more

thehive strangebee-helm 1.0.6

1 of the 7 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
bitnamilegacy/cassandra:4.1.7-debian-12-r32b7a217999a1
python@3.11.11-0
3.10.21

Open the chart page →

16,210
hertzbeathertzbeatOfficialVerified publisher1.8.12 of 4See more

hertzbeat hertzbeat 1.8.1

2 of the 4 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
apache/hertzbeat:1.8.075d48a62748f
python3.12@3.12.3-1ubuntu0.11
3.12.3-1ubuntu0.15
apache/hertzbeat-collector:1.8.0a2bab1be574c
python3.12@3.12.3-1ubuntu0.11
3.12.3-1ubuntu0.15

Open the chart page →

14,000
dumpscriptcloudscriptVerified publisher1.8.31 of 1See more

dumpscript cloudscript 1.8.3

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
ghcr.io/cloudscript-technology/dumpscript:v0.0.42-alpine-edgefce5b6fd161c
python3@3.14.3-r0
3.14.7-r0

Open the chart page →

2,125
dask-kubernetes-operatordask2026.3.01 of 1See more

dask-kubernetes-operator dask 2026.3.0

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
python3.13@3.13.5-2
3.13.5-2+deb13u3

Open the chart page →

9,316
zabbix-kubernetes-discoverydjerfyVerified publisher1.4.201 of 1See more

zabbix-kubernetes-discovery djerfy 1.4.20

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
ghcr.io/djerfy/zabbix-kubernetes-discovery:v1.4.207a50c07e7c69
python3.12@3.12.3-1ubuntu0.3
3.12.3-1ubuntu0.15

Open the chart page →

4,147
headscaleheadscaleVerified publisher1.0.191 of 3See more

headscale headscale 1.0.19

1 of the 3 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
alpine/k8s:1.36.244ef4942e171
python3@3.14.5-r1
3.14.7-r0

Open the chart page →

3,383
coreinstill-aiOfficialVerified publisher0.1.753 of 15See more

core instill-ai 0.1.75

3 of the 15 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
instill/artifact-backend:b28766ac4a393e601ed
python3.13@3.13.5-2
3.13.5-2+deb13u3
instill/mgmt-backend:d0933d4ebe12f77a3f9
python3.13@3.13.5-2
3.13.5-2+deb13u3
instill/model-backend:611f0f2e980125e5ba5
python3.13@3.13.5-2
3.13.5-2+deb13u3

Open the chart page →

30,816
dayz-dedicated-serverjespernohrVerified publisher0.1.21 of 3See more

dayz-dedicated-server jespernohr 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
ghcr.io/jespernohr/dayz-dedicated-server:0.1.1ec01d3ac7887
python3.12@3.12.3-1ubuntu0.2
3.12.3-1ubuntu0.15

Open the chart page →

4,309
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/rabbitmq:4.2-management3408107e5cc4
python3.12@3.12.3-1ubuntu0.9
3.12.3-1ubuntu0.15

Open the chart page →

107,811
nominatimrobjuz6.4.11 of 4See more

nominatim robjuz 6.4.1

1 of the 4 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
mediagis/nominatim:5.3.27923a8e67197
python3.12@3.12.3-1ubuntu0.13
3.12.3-1ubuntu0.15

Open the chart page →

8,690
vaultvaultVerified publisher1.22.01 of 4See more

vault vault 1.22.0

1 of the 4 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
alpine/k8s:1.35.5d870622d0040
python3@3.14.3-r0
3.14.7-r0

Open the chart page →

4,243
wgerwgerOfficialVerified publisher1.0.01 of 8See more

wger wger 1.0.0

1 of the 8 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
wger/server:2.6997ead43aabd
python3.12@3.12.3-1ubuntu0.13
3.12.3-1ubuntu0.15

Open the chart page →

8,491
akeyless-api-gatewayakeyless-services-helmVerified publisher1.62.221 of 1See more

akeyless-api-gateway akeyless-services-helm 1.62.22

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
akeyless/base:latest759e4289fae8
python3.12@3.12.3-1ubuntu0.13
3.12.3-1ubuntu0.15

Open the chart page →

2,358
aramid-indexerbiatec-repoVerified publisher3.9.03 of 5See more

aramid-indexer biatec-repo 3.9.0

3 of the 5 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
scholtz2/aramid-algo-follow-node:v4.3.0-stable1ec63eca86b6
python3.12@3.12.3-1ubuntu0.8
3.12.3-1ubuntu0.15
scholtz2/aramid-conduit:v1.9.0-stable3a3b3d3277d2
python3.14@3.14.4-1
3.14.4-1ubuntu0.1
scholtz2/aramid-indexer:v3.9.0-stable6770214bc881
python3.14@3.14.4-1
3.14.4-1ubuntu0.1

Open the chart page →

13,357
aramid-relaybiatec-repoVerified publisher4.4.11 of 1See more

aramid-relay biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
scholtz2/aramid-algo-node:v4.4.1-stable70263d8fab5b
python3.12@3.12.3-1ubuntu0.8
3.12.3-1ubuntu0.15

Open the chart page →

5,059
self-hostbitwarden2.4.01 of 11See more

self-host bitwarden 2.4.0

1 of the 11 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
mcr.microsoft.com/mssql/server:2025-CU5-ubuntu-24.04cee0f4db03b5
python3.12@3.12.3-1ubuntu0.13
3.12.3-1ubuntu0.15

Open the chart page →

5,190
easyhaproxybyjgVerified publisher2.0.41 of 1See more

easyhaproxy byjg 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
byjg/easy-haproxy:6.1.1230fdb7b00ae
python3@3.14.5-r0
3.14.7-r0

Open the chart page →

933
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
python3.13@3.13.5-2
3.13.5-2+deb13u3

Open the chart page →

11,205
datacube-explorerdatacube-charts0.5.321 of 1See more

datacube-explorer datacube-charts 0.5.32

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
opendatacube/explorer:latest120457ffcd69
python3.12@3.12.3-1ubuntu0.8
3.12.3-1ubuntu0.15

Open the chart page →

4,854
matomodigitalist-open-cloud-matomo12.0.201 of 3See more

matomo digitalist-open-cloud-matomo 12.0.20

1 of the 3 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
digitalist/matomo:5.12.0bc4aeeaea769
python3@3.14.5-r0
3.14.7-r0

Open the chart page →

3,539
rstudiodsri-helm-charts0.1.281 of 1See more

rstudio dsri-helm-charts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
ghcr.io/maastrichtu-ids/rstudio:latest981aa4c109e1
python3.12@3.12.3-1ubuntu0.5
3.12.3-1ubuntu0.15

Open the chart page →

5,670
roundcubeencircle360-ossVerified publisher0.8.31 of 1See more

roundcube encircle360-oss 0.8.3

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
roundcube/roundcubemail:1.6.16-apache-nonroot17d9d9580962
python3.13@3.13.5-2+deb13u2
3.13.5-2+deb13u3

Open the chart page →

5,584
zabbix-server-mysqlfermosit3.0.21 of 4See more

zabbix-server-mysql fermosit 3.0.2

1 of the 4 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
zabbix/zabbix-web-nginx-mysql:ubuntu-6.4-latest0e5f69c4c54e
python3.12@3.12.3-1ubuntu0.4
3.12.3-1ubuntu0.15

Open the chart page →

12,840
valheimgeek-cookbookVerified publisher4.4.21 of 1See more

valheim geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
ghcr.io/lloesche/valheim-server:latest20fde516ce31
python3.13@3.13.5-2
3.13.5-2+deb13u3

Open the chart page →

4,879
IMgrycapOfficialVerified publisher1.8.01 of 3See more

IM grycap 1.8.0

1 of the 3 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
ghcr.io/grycap/im:latest06a16d4f279f
python3.12@3.12.3-1ubuntu0.8
3.12.3-1ubuntu0.15

Open the chart page →

4,132
iris-webappiris-webapp0.2.41 of 2See more

iris-webapp iris-webapp 0.2.4

1 of the 2 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
python3.13@3.13.5-2
3.13.5-2+deb13u3

Open the chart page →

11,764
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
python-3.13@3.13.7-r0
3.13.14-r0

Open the chart page →

4,292
prometheus-pve-exporterm0nsterrr-prometheus-pve-exporterVerified publisher2.7.01 of 1See more

prometheus-pve-exporter m0nsterrr-prometheus-pve-exporter 2.7.0

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
prompve/prometheus-pve-exporter:3.10.04867684c0a93
python3@3.14.5-r0
3.14.7-r0

Open the chart page →

348
magentomagento3.2.31 of 12See more

magento magento 3.2.3

1 of the 12 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
library/rabbitmq:4.1.0-management935b3f84c1e4
python3.12@3.12.3-1ubuntu0.5
3.12.3-1ubuntu0.15

Open the chart page →

13,479
mw-kube-agent-v2middleware-labsVerified publisher2.8.61 of 1See more

mw-kube-agent-v2 middleware-labs 2.8.6

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/mw-kube-agent:1.12.09c7bc0f9bb35
python3.12@3.12.3-1ubuntu0.3
3.12.3-1ubuntu0.15

Open the chart page →

4,137
photoprismmmontesVerified publisher0.14.01 of 1See more

photoprism mmontes 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
photoprism/photoprism:251130db16ee6b1ba3
python3.13@3.13.7-1ubuntu0.1
no fix listed

Open the chart page →

11,103
redminemt1905027.3.41 of 3See more

redmine mt190502 7.3.4

1 of the 3 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
library/redmine:6.1.204ac44a2595b
python3.13@3.13.5-2+deb13u2
3.13.5-2+deb13u3

Open the chart page →

7,527
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
python3.13@3.13.5-2+deb13u2
3.13.5-2+deb13u3

Open the chart page →

7,035
privacyideaprivacyidea1.0.61 of 2See more

privacyidea privacyidea 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
gpappsoft/privacyidea-docker:3.12.2af7841adad26
python-3.13@3.13.10-r0
3.13.14-r0

Open the chart page →

5,440
rabbitmqrabbitmq-magefleet1.2.01 of 1See more

rabbitmq rabbitmq-magefleet 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
library/rabbitmq:4.1.0-management935b3f84c1e4
python3.12@3.12.3-1ubuntu0.5
3.12.3-1ubuntu0.15

Open the chart page →

2,762
sogosogoVerified publisher0.3.51 of 2See more

sogo sogo 0.3.5

1 of the 2 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
sonroyaalmerol/docker-sogo:5.12.43f60f3abe990
python3.13@3.13.5-2
3.13.5-2+deb13u3

Open the chart page →

7,126
streamvisorstreamvisorVerified publisher4.1.61 of 1See more

streamvisor streamvisor 4.1.6

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
ghcr.io/streamvisor/streamvisor:4.1.40bc598b2ac9a
python3.12@3.12.3-1ubuntu0.13
3.12.3-1ubuntu0.15

Open the chart page →

2,826
vaultwarden-kubernetes-secretsvaultwarden-kubernetes-secrets0.0.0-main1 of 2See more

vaultwarden-kubernetes-secrets vaultwarden-kubernetes-secrets 0.0.0-main

1 of the 2 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
python3.12@3.12.3-1ubuntu0.10
3.12.3-1ubuntu0.15

Open the chart page →

4,010
wordpress-helmwordpress-helm0.2.91 of 4See more

wordpress-helm wordpress-helm 0.2.9

1 of the 4 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
aapjeisbaas/wp-frankenphp:v0.2.26b261abc7fb0
python3.13@3.13.5-2+deb13u2
3.13.5-2+deb13u3

Open the chart page →

8,217
graphserviceaerospike-helmVerified publisher3.3.01 of 1See more

graphservice aerospike-helm 3.3.0

1 of the 1 container images this version deploys carry CVE-2026-7774.

Container imageDigestPackageFixed in
aerospike/aerospike-graph-service:3.3.0f35739b97a46
python3@3.14.5-r0
3.14.7-r0

Open the chart page →

453

Container images carrying it

110 by charts deploying them

A fixed version is listed for 8 of the 8 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/streamingfast/go-ethereum:geth-v1.16.9-fh3.08e3cb38953a3
python3.12@3.12.3-1ubuntu0.10
3.12.3-1ubuntu0.15
1
ghcr.io/streamvisor/streamvisor:4.1.40bc598b2ac9a
python3.12@3.12.3-1ubuntu0.13
3.12.3-1ubuntu0.15
1
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
python-3.14@3.14.4-r2
3.14.6-r1
1
mcr.microsoft.com/mssql/server:2025-CU5-ubuntu-24.04cee0f4db03b5
python3.12@3.12.3-1ubuntu0.13
3.12.3-1ubuntu0.15
1
public.ecr.aws/groundcovercom/temporalio/admin-tools:1.29.7-20260730-1af8cea3b8538
python3.13@3.13.5-2+e30
3.13.5-2+e36
1
quay.io/opsmxpublic/rabbitmq:4.2-management3408107e5cc4
python3.12@3.12.3-1ubuntu0.9
3.12.3-1ubuntu0.15
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
python-3.14@3.14.2-r2
3.14.6-r1
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
python-3.14@3.14.2-r2
3.14.6-r1
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
python-3.14@3.14.2-r2
3.14.6-r1
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
python-3.14@3.14.2-r2
3.14.6-r1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.