CVE-2026-64679: Directory Traversal via Workspace Parameter in Atlantis
Vulnerability ID: CVE-2026-64679
CVSS Score: 8.1
Published: 2026-08-21
A critical path traversal vulnerability in Atlantis allows authenticated users or repository contributors to execute directory operations outside of the repository directory boundary via crafted workspace parameters in configuration files or API requests.
TL;DR
Unsanitized workspace parameters in Atlantis enable directory traversal, allowing attackers to create or delete arbitrary folders on the host filesystem.
Technical Details
- CWE ID: CWE-22
- Attack Vector: Network (N)
- CVSS Score: 8.1 (High)
- Exploit Status: Proof-of-Concept / Patched
- KEV Status: Not Listed
- Affected Versions: >= 0.19.8, < 0.45.0
Affected Systems
- Atlantis server running versions 0.19.8 through 0.44.2
-
atlantis: >= 0.19.8, < 0.45.0 (Fixed in:
0.45.0)
Code Analysis
Commit: ea4e4ce
Fix path traversal vulnerabilities in workspace path construction by introducing path validation helper EnsureSubPath and adding strict checks on repository and workspace names.
Mitigation Strategies
- Upgrade Atlantis to version 0.45.0 or later.
- Restrict pull request workflow validation permissions.
- Run the Atlantis service under an unprivileged user account.
Remediation Steps:
- Identify running Atlantis instances and determine their current version.
- Retrieve the updated container image or binary for version 0.45.0.
- Deploy the update to the target environment.
- Verify that workspace names containing directory traversal patterns are successfully blocked by the system.
References
- GitHub Security Advisory GHSA-26w5-6g95-gj28
- Official Patch Pull Request #6254
- Atlantis Release Tag v0.45.0
Read the full report for CVE-2026-64679 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)