Vulnerability-Lookup

GHSA-26W5-6G95-GJ28

Vulnerability from github – Published: 2026-08-21 20:55 – Updated: 2026-08-21 20:55

Summary

Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation

Details

Summary

Atlantis versions >= 0.19.8 and < 0.45.0 did not consistently validate user-controlled workspace values before using them to construct local workspace paths.

A crafted workspace value containing path traversal segments could cause Atlantis to resolve workspace paths outside the intended per-pull workspace directory. In vulnerable versions or code paths, Atlantis could create, use, or remove/recreate out-of-bounds directories with the privileges of the Atlantis process user, before Terraform rejected the invalid workspace name.

The issue is fixed in Atlantis 0.45.0.

Details

The issue is a path traversal vulnerability in Atlantis workspace handling. workspace values can be supplied through repository-level atlantis.yaml configuration accepted by the server or through authenticated API input. A value such as ../../../../../../../../tmp/f1-canary could escape the intended Atlantis workspace root.

In affected code paths, Atlantis used the resolved workspace path for local working-directory operations. For example, workspace values were joined into repo pull paths, and clone preparation paths could call directory removal/recreation operations such as os.RemoveAll and os.MkdirAll on the resolved directory.

PoC

In a local PoC using repo-level atlantis.yaml, the following workspace value caused Atlantis to resolve and use /tmp/f1-canary outside ~/.atlantis/repos/...:

version: 3
projects:
  - dir: .
    workspace: ../../../../../../../../tmp/f1-canary

Atlantis logs showed the out-of-bounds directory being created and Terraform being run with /tmp/f1-canary as the working directory. Terraform rejected the workspace name only after Atlantis had already used the out-of-bounds path.

Impact

A user who can cause Atlantis to process a crafted workspace value, for example through repository-level atlantis.yaml configuration accepted by the server or an authenticated /api/plan request, may cause filesystem operations to occur outside the intended workspace boundary.

Depending on the affected version, code path, deployment configuration, and filesystem permissions, this may result in unintended directory creation, deletion, or reuse, integrity impact to writable local paths, or denial of service. Containerized deployments may limit host impact, but writable mounted volumes and persistent Atlantis data paths remain relevant.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/runatlantis/atlantis"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.19.8"
            },
            {
              "fixed": "0.45.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-64679"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-21T20:55:33Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nAtlantis versions `\u003e= 0.19.8` and `\u003c 0.45.0` did not consistently validate user-controlled `workspace` values before using them to construct local workspace paths.\n\nA crafted workspace value containing path traversal segments could cause Atlantis to resolve workspace paths outside the intended per-pull workspace directory. In vulnerable versions or code paths, Atlantis could create, use, or remove/recreate out-of-bounds directories with the privileges of the Atlantis process user, before Terraform rejected the invalid workspace name.\n\nThe issue is fixed in Atlantis `0.45.0`.\n\n### Details\nThe issue is a path traversal vulnerability in Atlantis workspace handling. `workspace` values can be supplied through repository-level `atlantis.yaml` configuration accepted by the server or through authenticated API input. A value such as `../../../../../../../../tmp/f1-canary` could escape the intended Atlantis workspace root.\n\nIn affected code paths, Atlantis used the resolved workspace path for local working-directory operations. For example, workspace values were joined into repo pull paths, and clone preparation paths could call directory removal/recreation operations such as `os.RemoveAll` and `os.MkdirAll` on the resolved directory.\n\n### PoC\nIn a local PoC using repo-level `atlantis.yaml`, the following workspace value caused Atlantis to resolve and use `/tmp/f1-canary` outside `~/.atlantis/repos/...`:\n\n```yaml\nversion: 3\nprojects:\n  - dir: .\n    workspace: ../../../../../../../../tmp/f1-canary\n```\n\nAtlantis logs showed the out-of-bounds directory being created and Terraform being run with `/tmp/f1-canary` as the working directory. Terraform rejected the workspace name only after Atlantis had already used the out-of-bounds path.\n\n### Impact\nA user who can cause Atlantis to process a crafted `workspace` value, for example through repository-level `atlantis.yaml` configuration accepted by the server or an authenticated `/api/plan` request, may cause filesystem operations to occur outside the intended workspace boundary.\n\nDepending on the affected version, code path, deployment configuration, and filesystem permissions, this may result in unintended directory creation, deletion, or reuse, integrity impact to writable local paths, or denial of service. Containerized deployments may limit host impact, but writable mounted volumes and persistent Atlantis data paths remain relevant.",
  "id": "GHSA-26w5-6g95-gj28",
  "modified": "2026-08-21T20:55:33Z",
  "published": "2026-08-21T20:55:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28"
    },
    {
      "type": "WEB",
      "url": "https://github.com/runatlantis/atlantis/pull/6254"
    },
    {
      "type": "WEB",
      "url": "https://github.com/runatlantis/atlantis/commit/ea4e4ceebf8b387d015fff7ed8a7fcca33279afe"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/runatlantis/atlantis"
    },
    {
      "type": "WEB",
      "url": "https://github.com/runatlantis/atlantis/releases/tag/v0.45.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation"
}

CVE-2026-64679 (GCVE-0-2026-64679)

Vulnerability from cvelistv5 – Published: 2026-08-21 20:29 – Updated: 2026-08-25 17:05

Title

Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation

Summary

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated /api/plan input before joining them into local workspace paths. Traversal segments can escape the intended per-pull workspace directory and cause clone preparation or other working-directory code paths to call os.RemoveAll, os.MkdirAll, or related filesystem operations on out-of-bounds directories before Terraform rejects the invalid workspace name. This can create, delete, or reuse writable paths with the privileges of the Atlantis process, causing integrity loss or denial of service. This issue is fixed in version 0.45.0.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 17:04 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73 - External Control of File Name or Path

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/runatlantis/atlantis/security/…	x_refsource_CONFIRM
https://github.com/runatlantis/atlantis/pull/6254	x_refsource_MISC
https://github.com/runatlantis/atlantis/commit/ea…	x_refsource_MISC
https://github.com/runatlantis/atlantis/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
runatlantis	atlantis	Affected: >= 0.19.8, < 0.45.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64679",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T17:04:45.481426Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T17:05:09.821Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "atlantis",
          "vendor": "runatlantis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.19.8, \u003c 0.45.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated /api/plan input before joining them into local workspace paths. Traversal segments can escape the intended per-pull workspace directory and cause clone preparation or other working-directory code paths to call os.RemoveAll, os.MkdirAll, or related filesystem operations on out-of-bounds directories before Terraform rejects the invalid workspace name. This can create, delete, or reuse writable paths with the privileges of the Atlantis process, causing integrity loss or denial of service. This issue is fixed in version 0.45.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T20:29:55.106Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28"
        },
        {
          "name": "https://github.com/runatlantis/atlantis/pull/6254",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/runatlantis/atlantis/pull/6254"
        },
        {
          "name": "https://github.com/runatlantis/atlantis/commit/ea4e4ceebf8b387d015fff7ed8a7fcca33279afe",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/runatlantis/atlantis/commit/ea4e4ceebf8b387d015fff7ed8a7fcca33279afe"
        },
        {
          "name": "https://github.com/runatlantis/atlantis/releases/tag/v0.45.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/runatlantis/atlantis/releases/tag/v0.45.0"
        }
      ],
      "source": {
        "advisory": "GHSA-26w5-6g95-gj28",
        "discovery": "UNKNOWN"
      },
      "title": "Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-64679",
    "datePublished": "2026-08-21T20:29:55.106Z",
    "dateReserved": "2026-07-20T17:12:12.892Z",
    "dateUpdated": "2026-08-25T17:05:09.821Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-26W5-6G95-GJ28

Summary

Details

PoC

Impact

CVE-2026-64679 (GCVE-0-2026-64679)

Tags

Sightings

Nomenclature