CVE-2026-64679

Received Received - Intake

Path Traversal in Atlantis Terraform Automation Tool

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated /api/plan input before joining them into local workspace paths. Traversal segments can escape the intended per-pull workspace directory and cause clone preparation or other working-directory code paths to call os.RemoveAll, os.MkdirAll, or related filesystem operations on out-of-bounds directories before Terraform rejects the invalid workspace name. This can create, delete, or reuse writable paths with the privileges of the Atlantis process, causing integrity loss or denial of service. This issue is fixed in version 0.45.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-64679

EUVD

EUVD-2026-64142

Affected Vendors & Products

Vendor	Product	Version / Range
runatlantis	atlantis	From 0.19.8 (inc) to 0.45.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

Atlantis is a self-hosted application that handles Terraform pull request events via webhooks. Between versions 0.19.8 and 0.45.0, it fails to properly validate workspace values from user-controlled inputs like atlantis.yaml or /api/plan. This allows directory traversal sequences to escape intended workspace directories, leading to filesystem operations on unintended paths.

Detection Guidance

Detecting this vulnerability requires checking the Atlantis version and reviewing configuration files for unsafe workspace values. Check Atlantis version with: atlantis version. Inspect repository-level atlantis.yaml files for workspace values containing path traversal segments like ../. Monitor filesystem operations for unexpected directory creation or deletion by the Atlantis process.

Impact Analysis

An attacker could exploit this to create, delete, or reuse writable directories with Atlantis process privileges. This may cause data integrity loss, denial of service, or unauthorized system access depending on the filesystem permissions.

Mitigation Strategies

Upgrade Atlantis to version 0.45.0 or later immediately. Review and remove any unsafe workspace values in atlantis.yaml files. Restrict filesystem permissions for the Atlantis process to minimize potential damage. Monitor for unauthorized directory modifications or deletions.

Hi! I’m here to help you understand CVE-2026-64679. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70