Filecoin Pin upload-action EUVD-2026-114446

Exploitation requires the victim repository to use the specific documented two-workflow GitHub Actions pattern: an untrusted fork pull-request workflow that produces a build artifact, plus a privileged workflow_run workflow that downloads and uploads that artifact using a configured Filecoin walletPrivateKey secret, on upload-action versions <=1.0.1 (any 0.x or 1.0.x). The attacker is an external fork contributor and needs no repository privileges and no knowledge of the wallet private key. Limiting factors: the flaw is not exploitable unless this exact two-workflow configuration with a funded wallet is in place; the privileged workflow_run must actually execute (GitHub may require maintainer approval before running workflows from first-time or fork contributors), which is the user-interaction element reflected by UI:R; repositories not using the action or using the two-workflow pattern, or already on >=1.1.0, are unaffected.

This is a genuine authorization-bypass (CWE-863) in a CI/CD supply-chain context, but its real-world priority is moderate rather than emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L, base 8.2) indicates a network-reachable, low-complexity flaw that needs no attacker privileges but does require interaction (UI:R) - consistent with an external fork contributor driving a privileged workflow. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with a serious-but-not-actively-exploited issue. No CISA KEV listing is present in the input and no EPSS probability was supplied, so widespread or automated exploitation is not evidenced; the GHSA advisory includes a short PoC script that demonstrates the logic flaw (isForkPR resolving to false for workflow_run events) but it is a conceptual reference, not verified working end-to-end exploit code. Signals are internally consistent: high impact to integrity/availability of a specific, narrowly-deployed CI configuration, no confidentiality impact (the wallet private key is NOT disclosed), and exploitation gated on a particular two-workflow GitHub Actions pattern. Net: a real priority for the small population of repositories that use the affected action in the documented pattern, but low systemic risk because the preconditions are specific and the deployment footprint is niche.

A repository adopts the documented two-workflow pattern: an untrusted fork pull-request workflow builds an artifact and a privileged workflow_run workflow downloads and uploads it using the owner's funded Filecoin wallet. An external contributor opens a fork PR producing an attacker-controlled artifact; because the workflow_run event has no event.pull_request, fork detection fails and the privileged workflow initializes the wallet and uploads the attacker's artifact. A conceptual PoC in the GHSA advisory shows isForkPR evaluating to false and uploadStatus becoming pending-upload; it is not verified as a working exploit.