Source controller: Improper path handling allows traversal

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-47680 · Microsoft / collected KEV context

EUVD-2026-74295

GHSA-jjrm-hr5f-673x

GO-2026-5472

cve-program · CVE-2026-47680

• https://github.com/fluxcd/source-controller/security/advisories/GHSA-jjrm-hr5f-673x
• https://github.com/fluxcd/source-controller/pull/2054
• https://github.com/fluxcd/source-controller/commit/759bd6c451e7cc4327b38f42c8b671980165cb0e

euvd · EUVD-2026-74295

• https://github.com/fluxcd/source-controller/security/advisories/GHSA-jjrm-hr5f-673x
• https://github.com/fluxcd/source-controller/pull/2054
• https://github.com/fluxcd/source-controller/commit/759bd6c451e7cc4327b38f42c8b671980165cb0e

nvd · CVE-2026-47680

• https://github.com/fluxcd/source-controller/commit/759bd6c451e7cc4327b38f42c8b671980165cb0e
• https://github.com/fluxcd/source-controller/pull/2054
• https://github.com/fluxcd/source-controller/security/advisories/GHSA-jjrm-hr5f-673x

osv · GHSA-jjrm-hr5f-673x

• https://github.com/fluxcd/source-controller/security/advisories/GHSA-jjrm-hr5f-673x
• https://github.com/fluxcd/source-controller/pull/2054
• https://github.com/fluxcd/source-controller/commit/759bd6c451e7cc4327b38f42c8b671980165cb0e
• https://github.com/fluxcd/source-controller

osv · GO-2026-5472

• https://github.com/fluxcd/source-controller/security/advisories/GHSA-jjrm-hr5f-673x
• https://github.com/fluxcd/source-controller/commit/759bd6c451e7cc4327b38f42c8b671980165cb0e
• https://github.com/fluxcd/source-controller/pull/2054

No related operational record is retained in the current change model.