go-billy, a filesystem abstraction interface for Go, had multiple path traversal vulnerabilities before version 5.9.0 due to inconsistent path sanitization and boundary enforcement across its components. These flaws allowed crafted paths using sequences like '..' to escape the intended base directory restrictions, potentially exposing unintended filesystem locations. Although go-billy was not designed as a strong security boundary, applications relying on it for isolation could be affected. The vulnerability is addressed in version 5.9.0.

Successful exploitation could allow an attacker with at least limited privileges (PR:L) to read or write files outside the intended directory boundaries, leading to high confidentiality and integrity impacts. Availability is not affected. This could result in unauthorized access to sensitive files or modification of critical data within the filesystem context where go-billy is used.

Upgrade to go-billy version 5.9.0 or later, where this path traversal vulnerability is fixed. Since no additional vendor advisory or patch details are provided, users should verify the upgrade and test their applications accordingly. Patch status is confirmed by the version fix statement; no other mitigation steps are indicated.