CVE-2026-12567
Received Received - Intake
GitHub Workflows Symlink Path Traversal Vulnerability

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: Black Lantern Security

Description
The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-06-18
AI Q&A
2026-06-18
EPSS Evaluated
N/A
NVD
CVE-2026-12567
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability exists in the github_workflows module, which constructs local directory paths using repository names controlled by users without checking for symbolic links (symlinks). A local attacker who shares the scan directory can create a symlink at the expected output path. This causes workflow data to be written to a location chosen by the attacker instead of the intended directory.

Impact Analysis

This vulnerability allows a local attacker with access to the scan directory to redirect workflow data to arbitrary locations by planting symlinks. This could lead to unauthorized modification or overwriting of files, potentially causing data integrity issues or unexpected behavior in workflows.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12567. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart