CVE-2026-44973: 
Datadog Agent vulnerability analysis and mitigation

CVE-2026-44973 is a path traversal vulnerability (CWE-22) in go-billy, a filesystem abstraction library for Go maintained by the go-git project. Multiple path traversal issues exist across different components due to insufficient path sanitization and boundary enforcement, allowing crafted paths using .. sequences to escape intended base directories. The vulnerability affects github.com/go-git/go-billy/v5 versions prior to v5.9.0 and github.com/go-git/go-billy/v6 versions prior to v6.0.0-alpha.1; all versions prior to v5 are also likely affected. It was privately reported by researchers @faran66 and @vnykmshr, published to the GitHub Advisory Database on May 14, 2026, and assigned a CVSS v3.1 base score of 8.1 (High) (Github Advisory, go-billy Advisory).

The root cause is improper limitation of pathnames to restricted directories (CWE-22), specifically insufficient sanitization of user-supplied path components within the go-billy filesystem abstraction layer. The osfs.ChrootOS implementation is notably affected — it fails to consistently enforce base directory boundaries, allowing crafted paths containing .. sequences to resolve to locations outside the intended chroot-like directory. Exploitation requires low privileges (an authenticated user with access to a go-billy-backed filesystem interface) and no user interaction, and is achievable over the network with low attack complexity. The vulnerability is inconsistently present across built-in implementations, meaning applications that rely on go-billy for any level of filesystem isolation may be inadvertently exposed (Github Advisory, go-billy Advisory).

Successful exploitation allows an authenticated attacker to read or modify files outside the intended base directory, resulting in high confidentiality and high integrity impact with no availability impact. Applications using go-billy for filesystem isolation — such as those built on go-git for repository operations — may inadvertently expose sensitive files on the host filesystem to unauthorized access or tampering. There is no direct availability impact, but unauthorized file modification could enable further compromise of dependent systems or data (Github Advisory, go-billy Advisory).

1. Identify target: Locate an application that uses go-billy (particularly osfs.ChrootOS) for filesystem operations, such as a go-git-based service that accepts user-controlled file paths.
2. Authenticate: Obtain low-privilege access to the application (e.g., a standard user account or API token).
3. Craft malicious path: Construct a file path containing directory traversal sequences such as ../../etc/passwd or ../../sensitive/config that would resolve outside the intended base directory.
4. Submit crafted path: Supply the malicious path to any go-billy filesystem operation (e.g., Open, Create, Stat) exposed by the application's API or interface.
5. Access unintended files: Due to insufficient sanitization in osfs.ChrootOS, the path escapes the base directory boundary, granting read or write access to arbitrary files on the host filesystem (Github Advisory, go-billy Advisory).

• Logs: Application logs showing file access requests with path components containing .. sequences (e.g., ../../etc/passwd, ../../../var/); unexpected file access errors or successes for paths outside the configured base directory.
• File System: Unexpected access timestamps on sensitive files (e.g., /etc/passwd, /etc/shadow, configuration files) that should not be reachable from the application's working directory.
• Process: Go application processes accessing files outside their expected working directory tree, observable via system call auditing tools (e.g., auditd with -a always,exit -F arch=b64 -S open -S openat).
• Network: Unusual data exfiltration patterns following authenticated API calls that include encoded traversal sequences in path parameters.

Users should upgrade go-billy/v5 to version 5.9.0 or later, or go-billy/v6 to v6.0.0-alpha.1 or later. As a configuration-level mitigation, replace any use of osfs.ChrootOS with osfs.BoundOS using osfs.New(path, WithBoundOS()), as ChrootOS is deprecated in v5 and removed in v6. For applications requiring the strongest security boundary enforcement, upgrading to v6 is recommended, as it uses the traversal-resistant os.Root primitive introduced in Go's standard library. All versions prior to v5 are likely affected and should be upgraded to a supported version (Github Advisory, go-billy Advisory).

The vulnerability was responsibly disclosed privately to the go-git project by two independent researchers (@faran66 and @vnykmshr) before public disclosure. Red Hat has acknowledged the CVE and published a security advisory. The issue received coverage from automated vulnerability tracking services and security aggregators, but no significant public researcher commentary or media coverage has been identified beyond standard advisory distribution (Red Hat, go-billy Advisory).