EUVD-2026-38564
GHSA-fjv8-j4p5-cr9m
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
PR:L for required authentication, AC:H for structural inexploitability on released builds due to UUID validation; no availability impact applies.
Primary rating from Vendor (https://github.com/daytonaio/daytona).
CVSS VectorVendor: https://github.com/daytonaio/daytona
Lifecycle Timeline
2DescriptionCVE.org
Summary
A sandbox volume reference (volumeId, which may also be a volume name) was forwarded to the runner and used to build the host bind-mount source path without confinement. A reference containing path-traversal sequences could in principle resolve the mount source outside the intended per-volume base directory.
Impact
Had the traversal been reachable, an authenticated user could have caused the runner to bind-mount an unintended host path into their sandbox, with a worst-case impact of read and write access to other tenants' volume data (per-volume FUSE mounts are world-readable and writable).
Important: this path was not exploitable in any released version. A volume reference is validated against the database before it reaches the runner, and the volume id column is a UUID type, so a reference containing traversal sequences is rejected at validation time and the request fails before any mount is constructed. We could not reproduce cross-tenant access or an out-of-base host mount on a released build; the observable effect of the documented payload was a server-side validation error. Severity is assessed as Medium on that basis.
Patches
Fixed in v0.186.0. Volume references are now resolved to the canonical volume UUID server-side before reaching the runner, so a name can never flow downstream as a path component, and the runner confines the mount source to the volume base directory and rejects any non-UUID reference.
Workarounds
Upgrade to v0.186.0 or later. No configuration workaround is required for released versions, which were not exploitable.
Credit
Reported by @vnth4nhnt from CyStack.
AnalysisAI
Path traversal in Daytona's sandbox volume mount handling (versions <= 0.185.0) allowed a crafted volume reference containing traversal sequences to theoretically resolve the runner's bind-mount source path outside the intended per-volume base directory, with a worst-case impact of cross-tenant read/write access to other tenants' FUSE-mounted volume data. Critically, the vendor confirmed the vulnerability was NOT exploitable in any released version: volume references pass through UUID-type database validation before reaching the runner, structurally rejecting traversal payloads and producing a server-side validation error instead of an unintended mount. No public exploit has been identified and the CVE carries no CISA KEV listing, consistent with a latent code-path defect rather than an active attack surface.
Technical ContextAI
Daytona (pkg:go/github.com/daytonaio/daytona) is a cloud development environment platform written in Go. The runner component is responsible for constructing host bind-mount paths for sandbox volumes. In versions <= 0.185.0, the volume reference - either a UUID or a human-readable volume name - was forwarded from the API layer to the runner and used directly to build the host-side bind-mount source path without independent path confinement in the runner. CWE-20 (Improper Input Validation) is the root cause: the runner lacked its own enforcement that the resolved path remained within the designated volume base directory, relying implicitly on upstream structural guarantees. The de-facto protection came from the database layer's UUID column type, which rejects any non-UUID string (including traversal sequences) at validation time, so no traversal payload could propagate to the runner on released builds. The v0.186.0 fix adds explicit defense-in-depth: volume names are resolved to canonical UUIDs server-side before reaching the runner, and the runner now independently confines mount sources to the volume base directory and rejects non-UUID references.
RemediationAI
Upgrade Daytona to v0.186.0 or later, which is the vendor-confirmed patched release per GHSA-fjv8-j4p5-cr9m (https://github.com/daytonaio/daytona/security/advisories/GHSA-fjv8-j4p5-cr9m). Version 0.186.0 resolves volume references to canonical UUIDs on the server side before forwarding to the runner and adds runner-side confinement enforcing that mount sources stay within the volume base directory. No configuration-level workaround is required for existing released versions because the database UUID type constraint already prevents the traversal path from being reached; however, upgrading eliminates the latent code path entirely and removes dependence on that implicit upstream control. Operators running self-hosted deployments should prioritize upgrade in their next maintenance window.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and
An authenticated path traversal vulnerability in Langflow's file upload functionality allows attackers to write arbitrar
Arbitrary host file write in Incus before 7.1.0 lets a holder of S3 bucket credentials escape the storage volume via a p
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitra
An authorization bypass vulnerability in gRPC-Go allows attackers to circumvent path-based access control by sending HTT
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsin
Arbitrary file read in Langroid's SQLChatAgent (<= 0.63.0) lets an attacker who can influence the LLM-generated SQL exfi
Authentication bypass in the joserfc Python JOSE/JWT library (PyPI, versions <= 1.6.7) lets unauthenticated attackers fo
SSRF in the Bifrost AI gateway's multimodal URL-fetch path permits any client that can submit a Bedrock or Vertex provid
URLSecurityValidator SSRF bypass in compliance-trestle <= 4.0.3 allows a network-positioned attacker to reach cloud meta
Path traversal in rclone's `serve restic` REST API allows any attacker with network access to the endpoint to read, crea
Credential leakage in elixir-tesla (Tesla HTTP client for Elixir) versions 1.4.0 through 1.18.2 allows Authorization and
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today