high · 8.1CVE-2026-64679Aug 21, 2026

CVE-2026-64679: Atlantis Workspace Path Traversal Allows Out-of-Bounds Directory Operations

Rohit Hatagale
AI Security Researcher, SecureLayer7

A path traversal bug in Atlantis lets anyone who can supply a workspace name escape the intended working directory, potentially deleting or recreating directories anywhere the Atlantis process can…

Packagegithub.com/runatlantis/atlantis
Ecosystemgo
Affected>= 0.19.8, < 0.45.0
Fixed in0.45.0
CVE-2026-64679: Atlantis Workspace Path Traversal Allows Out-of-Bounds Directory Operations

The problem

Atlantis versions >= 0.19.8 and < 0.45.0 used the user-controlled workspace field to construct local filesystem paths without consistently rejecting dot-dot traversal segments.

In affected code paths, the resolved path was passed directly to os.RemoveAll and os.MkdirAll, so a crafted workspace value could delete or recreate an arbitrary directory before Terraform ever rejected the invalid name. A workspace value can be supplied via repo-level atlantis.yaml (if the server accepts it) or through an authenticated /api/plan request.

Proof of concept

A working proof-of-concept for CVE-2026-64679 in github.com/runatlantis/atlantis, with the exact payload below.

yaml
# atlantis.yaml in the attacker-controlled repo
version: 3
projects:
  - dir: .
    workspace: ../../../../../../../../tmp/f1-canary

Atlantis joined the unsanitized workspace string into the repo pull path (e.g. ~/.atlantis/repos/<owner>/<repo>/<pr>/<workspace>) using standard filepath join, which resolves ../.. segments normally.

The resolved out-of-bounds path was then used for clone-preparation operations such as os.RemoveAll and os.MkdirAll before Terraform ran. Terraform ultimately rejected the workspace name, but the filesystem damage had already occurred.

The patch (PR #6254, commit ea4e4ce) hardened path handling for CWE-22 by validating the workspace value before any path construction, rejecting inputs that contain path traversal sequences.

The fix

Upgrade to Atlantis 0.45.0 or later. If an immediate upgrade is not possible, restrict who can push atlantis.yaml to your repositories and disable unauthenticated or broadly-authorized API access to /api/plan.

Reporter not attributed.

References: [1][2][3][4][5]

Related research