Is CVE-2026-44973 actively exploited?

No active exploitation of CVE-2026-44973 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-44973 be exploited remotely?

Yes. CVE-2026-44973 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-44973?

CVE-2026-44973 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2026-44973

HIGH

CVE-2026-44973

CWE-22Published: May 28, 2026· Updated: May 29, 2026

8.1

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:17.0th

Official Description

Billy is an interface filesystem abstraction for Go. Prior to 5.9.0, multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories. While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on go-billy for some level of isolation may inadvertently expose access to unintended filesystem locations. This vulnerability is fixed in 5.9.0.

NVD Source

Technical Analysis

CVE-2026-44973 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 8.1.