{"id":"GO-2026-6273","summary":"Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation in github.com/runatlantis/atlantis","details":"Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation in github.com/runatlantis/atlantis","aliases":["CVE-2026-64679","GHSA-26w5-6g95-gj28"],"modified":"2026-08-25T23:51:38.056368146Z","published":"2026-08-25T15:00:08Z","database_specific":{"review_status":"UNREVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6273"},"references":[{"type":"ADVISORY","url":"https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28"},{"type":"FIX","url":"https://github.com/runatlantis/atlantis/commit/ea4e4ceebf8b387d015fff7ed8a7fcca33279afe"},{"type":"FIX","url":"https://github.com/runatlantis/atlantis/pull/6254"},{"type":"WEB","url":"https://github.com/runatlantis/atlantis/releases/tag/v0.45.0"}],"affected":[{"package":{"name":"github.com/runatlantis/atlantis","ecosystem":"Go","purl":"pkg:golang/github.com/runatlantis/atlantis"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.19.8"},{"fixed":"0.45.0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/runatlantis/atlantis/server/events","symbols":["DefaultProjectCommandRunner.Apply","DefaultProjectCommandRunner.Import","DefaultProjectCommandRunner.Plan","DefaultProjectCommandRunner.PolicyCheck","DefaultProjectCommandRunner.StateRm","DefaultProjectCommandRunner.Version","DefaultProjectCommandRunner.doApply","DefaultProjectCommandRunner.doImport","DefaultProjectCommandRunner.doPlan","DefaultProjectCommandRunner.doPolicyCheck","DefaultProjectCommandRunner.doStateRm","DefaultProjectCommandRunner.doVersion","EventParser.ParseAPIPlanRequest","EventParser.ParseAzureDevopsPull","EventParser.ParseAzureDevopsPullEvent","EventParser.ParseAzureDevopsRepo","EventParser.ParseBitbucketCloudPullCommentEvent","EventParser.ParseBitbucketCloudPullEvent","EventParser.ParseBitbucketServerPullCommentEvent","EventParser.ParseBitbucketServerPullEvent","EventParser.ParseGiteaIssueCommentEvent","EventParser.ParseGiteaPull","EventParser.ParseGiteaPullRequestEvent","EventParser.ParseGiteaRepo","EventParser.ParseGithubIssueCommentEvent","EventParser.ParseGithubPull","EventParser.ParseGithubPullEvent","EventParser.ParseGithubRepo","EventParser.ParseGitlabMergeRequestCommentEvent","EventParser.ParseGitlabMergeRequestEvent","FileWorkspace.Clone","FileWorkspace.Delete","FileWorkspace.DeleteForWorkspace","FileWorkspace.DeletePlan","FileWorkspace.GetGitUntrackedFiles","FileWorkspace.GetPullDir","FileWorkspace.GetWorkingDir","FileWorkspace.GitReadLock","FileWorkspace.MergeAgain","FileWorkspace.cloneDir","FileWorkspace.repoPullDir","FileWorkspace.validateCloneDir"]},{"path":"github.com/runatlantis/atlantis/server/core/config/raw","symbols":["Project.Validate"]},{"symbols":["NewRepo"],"path":"github.com/runatlantis/atlantis/server/events/models"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6273.json"}}],"schema_version":"1.9.0"}