Abstruse
Monthly
Path traversal in the worker Cache Endpoint of bleenco Abstruse (an open-source CI/CD platform) lets remote, unauthenticated attackers read files outside the intended cache directory by manipulating the 'File' argument. All versions up to and including 2.1.0 are affected, and publicly available exploit code exists (no confirmed active exploitation per CISA KEV). Impact is bounded to information disclosure: the AV:N/PR:N/UI:N vector enables unauthenticated access, while VC:L indicates read-only exposure of files readable by the worker process, with no write or code-execution primitive.
Path traversal in the worker Cache Endpoint of bleenco Abstruse (an open-source CI/CD platform) lets remote, unauthenticated attackers read files outside the intended cache directory by manipulating the 'File' argument. All versions up to and including 2.1.0 are affected, and publicly available exploit code exists (no confirmed active exploitation per CISA KEV). Impact is bounded to information disclosure: the AV:N/PR:N/UI:N vector enables unauthenticated access, while VC:L indicates read-only exposure of files readable by the worker process, with no write or code-execution primitive.