{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3abeta9gateway/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:beta9:gateway:*:*:*:*:*:*:*:*","cpe:2.3:a:beta9:worker:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-120308"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Gateway (\u003c 0.1.776)","Worker (\u003c 0.1.756)"],"_cs_severities":["critical"],"_cs_tags":["path-traversal","sandbox-escape","cloud"],"_cs_type":"advisory","_cs_vendors":["Beta9"],"content_html":"\u003cp\u003eA path traversal vulnerability exists in Beta9 gateway and worker components where volume identifiers are not validated for ownership or path constraints. By providing a volume identifier containing parent-directory traversal sequences, an authenticated tenant can cause the worker to bind-mount directories from the host filesystem into their sandbox. This grants read/write access to worker files and data belonging to other tenants. This vulnerability is confirmed in gateway version 0.1.769 and worker version 0.1.745.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA tenant with a workspace token can perform unauthorized read and write operations on the underlying worker filesystem, potentially resulting in cross-tenant data exposure and host system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePatch all Beta9 deployments by upgrading the gateway component to version 0.1.776 or later and the worker component to version 0.1.756 or later. These versions implement strict validation of volume identifiers and ownership checks.\u003c/p\u003e\n","date_modified":"2026-11-01T14:53:59Z","date_published":"2026-11-01T14:53:59Z","id":"https://feed.craftedsignal.io/briefs/2026-11-beta9-volume-traversal/","summary":"A path traversal vulnerability in the Beta9 gateway fails to validate volume ownership and paths, allowing tenants to access arbitrary worker files and other tenants data.","title":"Beta9: Sandbox escape via volume mount path traversal (CVE-2026-120308)","url":"https://feed.craftedsignal.io/briefs/2026-11-beta9-volume-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:beta9:gateway:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}