go-billy is a filesystem abstraction interface for Go. Before version 5.9.0, it contained multiple path traversal vulnerabilities due to improper limitation of pathnames to restricted directories (CWE-22). These issues stem from inconsistent path sanitization and boundary enforcement across built-in implementations, allowing crafted paths (e.g., using '..') to escape the intended base directory. Applications relying on go-billy for isolation may inadvertently expose unintended filesystem locations. The vulnerability is addressed in go-billy 5.9.0.

Successful exploitation can allow an attacker with limited privileges (PR:L) to bypass directory restrictions and access or read files outside the intended directory boundaries, potentially leading to disclosure of sensitive information (high confidentiality impact) and integrity compromise. Availability is not impacted. No known active exploits have been reported.

Upgrade to go-billy version 5.9.0 or later, where this path traversal vulnerability is fixed. Patch status is not explicitly stated in the vendor advisory, but the description confirms the issue is resolved in 5.9.0. No alternative mitigations are indicated.