https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 27 Aug 2026 05:34:40 +0000 https://vulnerability.circl.lu/sighting/2d9bd437-bc73-46a7-9aca-c6940124bd82/export {"uuid": "2d9bd437-bc73-46a7-9aca-c6940124bd82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64679", "type": "seen", "source": "https://gist.github.com/alon710/ab99d0934f6a3237c0cc69fe76b31465", "content": "# CVE-2026-64679: CVE-2026-64679: Directory Traversal via Workspace Parameter in Atlantis\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-64679\n\n## Summary\nA critical path traversal vulnerability in Atlantis allows authenticated users or repository contributors to execute directory operations outside of the repository directory boundary via crafted workspace parameters in configuration files or API requests.\n\n## TL;DR\nUnsanitized workspace parameters in Atlantis enable directory traversal, allowing attackers to create or delete arbitrary folders on the host filesystem.\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network (N)\n- **CVSS Score**: 8.1 (High)\n- **Exploit Status**: Proof-of-Concept / Patched\n- **KEV Status**: Not Listed\n- **Affected Versions**: >= 0.19.8, < 0.45.0\n\n## Affected Systems\n\n- Atlantis server running versions 0.19.8 through 0.44.2\n- **atlantis**: >= 0.19.8, < 0.45.0 (Fixed in: `0.45.0`)\n\n## Mitigation\n\n- Upgrade Atlantis to version 0.45.0 or later.\n- Restrict pull request workflow validation permissions.\n- Run the Atlantis service under an unprivileged user account.\n\n**Remediation Steps:**\n1. Identify running Atlantis instances and determine their current version.\n2. Retrieve the updated container image or binary for version 0.45.0.\n3. Deploy the update to the target environment.\n4. Verify that workspace names containing directory traversal patterns are successfully blocked by the system.\n\n## References\n\n- [GitHub Security Advisory GHSA-26w5-6g95-gj28](https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28)\n- [Official Patch Pull Request #6254](https://github.com/runatlantis/atlantis/pull/6254)\n- [Atlantis Release Tag v0.45.0](https://github.com/runatlantis/atlantis/releases/tag/v0.45.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-64679) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T06:31:28.514583Z"} {"uuid": "2d9bd437-bc73-46a7-9aca-c6940124bd82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64679", "type": "seen", "source": "https://gist.github.com/alon710/ab99d0934f6a3237c0cc69fe76b31465", "content": "# CVE-2026-64679: CVE-2026-64679: Directory Traversal via Workspace Parameter in Atlantis\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-64679\n\n## Summary\nA critical path traversal vulnerability in Atlantis allows authenticated users or repository contributors to execute directory operations outside of the repository directory boundary via crafted workspace parameters in configuration files or API requests.\n\n## TL;DR\nUnsanitized workspace parameters in Atlantis enable directory traversal, allowing attackers to create or delete arbitrary folders on the host filesystem.\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network (N)\n- **CVSS Score**: 8.1 (High)\n- **Exploit Status**: Proof-of-Concept / Patched\n- **KEV Status**: Not Listed\n- **Affected Versions**: >= 0.19.8, < 0.45.0\n\n## Affected Systems\n\n- Atlantis server running versions 0.19.8 through 0.44.2\n- **atlantis**: >= 0.19.8, < 0.45.0 (Fixed in: `0.45.0`)\n\n## Mitigation\n\n- Upgrade Atlantis to version 0.45.0 or later.\n- Restrict pull request workflow validation permissions.\n- Run the Atlantis service under an unprivileged user account.\n\n**Remediation Steps:**\n1. Identify running Atlantis instances and determine their current version.\n2. Retrieve the updated container image or binary for version 0.45.0.\n3. Deploy the update to the target environment.\n4. Verify that workspace names containing directory traversal patterns are successfully blocked by the system.\n\n## References\n\n- [GitHub Security Advisory GHSA-26w5-6g95-gj28](https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28)\n- [Official Patch Pull Request #6254](https://github.com/runatlantis/atlantis/pull/6254)\n- [Atlantis Release Tag v0.45.0](https://github.com/runatlantis/atlantis/releases/tag/v0.45.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-64679) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T06:31:28.514583Z"} https://vulnerability.circl.lu/sighting/2d9bd437-bc73-46a7-9aca-c6940124bd82/export Sat, 22 Aug 2026 06:31:28 +0000 https://vulnerability.circl.lu/sighting/205d8d03-9343-48eb-9e63-fdf603f962b8/export {"uuid": "205d8d03-9343-48eb-9e63-fdf603f962b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64679", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtn6l3hsty2o", "content": "\ud83d\udfe0 CVE-2026-64679 - High (8.1)\n\nAtlantis is a self-hosted golang application that listens for Terraform pull request events via w...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-64679/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-22T02:01:39.065105Z"} {"uuid": "205d8d03-9343-48eb-9e63-fdf603f962b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64679", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtn6l3hsty2o", "content": "\ud83d\udfe0 CVE-2026-64679 - High (8.1)\n\nAtlantis is a self-hosted golang application that listens for Terraform pull request events via w...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-64679/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-22T02:01:39.065105Z"} https://vulnerability.circl.lu/sighting/205d8d03-9343-48eb-9e63-fdf603f962b8/export Sat, 22 Aug 2026 02:01:39 +0000 https://vulnerability.circl.lu/sighting/6794ca95-ef31-4f3c-8ed0-da8b39656c63/export {"uuid": "6794ca95-ef31-4f3c-8ed0-da8b39656c63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-64679", "type": "published-proof-of-concept", "source": "https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28", "content": "", "creation_timestamp": "2026-08-21T22:35:19.658411Z"} {"uuid": "6794ca95-ef31-4f3c-8ed0-da8b39656c63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-64679", "type": "published-proof-of-concept", "source": "https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28", "content": "", "creation_timestamp": "2026-08-21T22:35:19.658411Z"} https://vulnerability.circl.lu/sighting/6794ca95-ef31-4f3c-8ed0-da8b39656c63/export Fri, 21 Aug 2026 22:35:19 +0000