GitHub Workflows Symlink Path Traversal Vulnerability

Publication date: 2026-06-17

Last updated on: 2026-06-22

Assigner: Black Lantern Security

Description

The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-17

Last Modified

2026-06-22

Generated

2026-07-08

AI Q&A

2026-06-18

EPSS Evaluated

2026-07-06

NVD

CVE-2026-12567

EUVD

EUVD-2026-37816

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

The vulnerability exists in the github_workflows module, which constructs local directory paths using repository names controlled by users without checking for symbolic links (symlinks). A local attacker who shares the scan directory can create a symlink at the expected output path. This causes workflow data to be written to a location chosen by the attacker instead of the intended directory.

Impact Analysis

This vulnerability allows a local attacker with access to the scan directory to redirect workflow data to arbitrary locations by planting symlinks. This could lead to unauthorized modification or overwriting of files, potentially causing data integrity issues or unexpected behavior in workflows.

Hi! I’m here to help you understand CVE-2026-12567. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70