{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/atlantis/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-64679"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Atlantis (0.19.8 to 0.44.9)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Atlantis"],"content_html":"\u003cp\u003eAtlantis versions 0.19.8 through 0.44.9 contain a path traversal vulnerability in its workspace handling mechanism. The application fails to properly sanitize the \u003ccode\u003eworkspace\u003c/code\u003e value provided in repository-level \u003ccode\u003eatlantis.yaml\u003c/code\u003e configuration files or through authenticated API requests. By injecting path traversal sequences (e.g., \u003ccode\u003e../../\u003c/code\u003e), an attacker can cause the Atlantis process to resolve workspace paths outside of the designated \u003ccode\u003e~/.atlantis/repos/\u003c/code\u003e directory.\u003c/p\u003e\n\u003cp\u003eWhen Atlantis performs workspace setup, it executes filesystem operations such as \u003ccode\u003eos.RemoveAll\u003c/code\u003e and \u003ccode\u003eos.MkdirAll\u003c/code\u003e on the resolved path before delegating to Terraform. Because these operations are executed with the permissions of the Atlantis process user, an authenticated user or an attacker capable of submitting a PR with a malicious \u003ccode\u003eatlantis.yaml\u003c/code\u003e can trigger unintended directory creation, deletion, or modification on the host system or within mounted container volumes. The issue is addressed in Atlantis version 0.45.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized manipulation of the filesystem within the context of the Atlantis process. This can lead to the deletion of critical local data, unauthorized creation of directories, or the reuse of arbitrary paths during Terraform execution. While containerization may mitigate host-wide impacts, persistent volumes and internal Atlantis data paths remain exposed. This vulnerability poses significant integrity and denial-of-service risks to organizations relying on Atlantis for Infrastructure as Code automation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Atlantis to version 0.45.0 or later immediately to resolve CVE-2026-64679.\u003c/li\u003e\n\u003cli\u003eAudit repository-level \u003ccode\u003eatlantis.yaml\u003c/code\u003e files for any suspicious \u003ccode\u003eworkspace\u003c/code\u003e parameter values containing directory traversal sequences.\u003c/li\u003e\n\u003cli\u003eRestrict the permissions of the user account running the Atlantis service to the minimum required for its operation, ensuring it cannot modify sensitive system directories.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for unexpected directory deletion or creation events occurring within the application's working directories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-22T01:17:31Z","date_published":"2026-08-22T01:17:31Z","id":"https://feed.craftedsignal.io/briefs/2026-08-atlantis-path-traversal/","summary":"Atlantis versions 0.19.8 through 0.44.9 are vulnerable to path traversal (CVE-2026-64679) allowing unauthorized directory creation or deletion outside the intended workspace root.","title":"Path Traversal in Atlantis Workspace Configuration","url":"https://feed.craftedsignal.io/briefs/2026-08-atlantis-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Atlantis","version":"https://jsonfeed.org/version/1.1"}