CVE-2026-64679: Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation
Atlantis versions >= 0.19.8 and < 0.45.0 did not consistently validate user-controlled workspace values before using them to construct local workspace paths.
A crafted workspace value containing path traversal segments could cause Atlantis to resolve workspace paths outside the intended per-pull workspace directory. In vulnerable versions or code paths, Atlantis could create, use, or remove/recreate out-of-bounds directories with the privileges of the Atlantis process user, before Terraform rejected the invalid workspace name.
The issue is fixed in Atlantis 0.45.0.
References
- github.com/advisories/GHSA-26w5-6g95-gj28
- github.com/runatlantis/atlantis/commit/ea4e4ceebf8b387d015fff7ed8a7fcca33279afe
- github.com/runatlantis/atlantis/pull/6254
- github.com/runatlantis/atlantis/releases/tag/v0.45.0
- github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28
- nvd.nist.gov/vuln/detail/CVE-2026-64679
Code Behaviors & Features
Detect and mitigate CVE-2026-64679 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →