EUVD-2026-64142
GHSA-26w5-6g95-gj28
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network delivery via webhook or API requires VCS collaborator auth (PR:L); no confidentiality impact as exploitation is limited to filesystem path creation and deletion.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated /api/plan input before joining them into local workspace paths. Traversal segments can escape the intended per-pull workspace directory and cause clone preparation or other working-directory code paths to call os.RemoveAll, os.MkdirAll, or related filesystem operations on out-of-bounds directories before Terraform rejects the invalid workspace name. This can create, delete, or reuse writable paths with the privileges of the Atlantis process, causing integrity loss or denial of service. This issue is fixed in version 0.45.0.
AnalysisAI
Path traversal in Atlantis workspace handling (versions 0.19.8 through 0.44.x) allows authenticated users to escape the intended workspace directory boundary, triggering os.RemoveAll and os.MkdirAll operations on arbitrary filesystem paths with Atlantis process privileges. A crafted workspace value such as '../../../../../../../../tmp/f1-canary' - supplied via repository atlantis.yaml or authenticated /api/plan API input - causes Atlantis to operate on out-of-bounds directories before Terraform rejects the invalid workspace name. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated user who can either commit an atlantis.yaml to a repository whose pull requests Atlantis is configured to process, or submit a crafted authenticated /api/plan HTTP request. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) reflects network-accessible exploitation requiring only low-privilege authentication, with high integrity and availability impact but no confidentiality loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Atlantis to version 0.45.0, the vendor-released patch (https://github.com/runatlantis/atlantis/releases/tag/v0.45.0), which introduces both input-layer workspace validation and runtime path boundary enforcement across all command runners. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Atlantis and document their versions to determine exposure scope, particularly instances in production that orchestrate critical infrastructure changes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Rated high sev
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in t
The /github-app/setup endpoint in Atlantis through 0.47.1 is completely unauthenticated, exposing GitHub App credentials
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Rated medium s
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today