Description

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated /api/plan input before joining them into local workspace paths. Traversal segments can escape the intended per-pull workspace directory and cause clone preparation or other working-directory code paths to call os.RemoveAll, os.MkdirAll, or related filesystem operations on out-of-bounds directories before Terraform rejects the invalid workspace name. This can create, delete, or reuse writable paths with the privileges of the Atlantis process, causing integrity loss or denial of service. This issue is fixed in version 0.45.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-21T21:17:01.920Z",
  "pubdate": "2026-08-21T21:17:01.920Z",
  "executiveSummary": "A path traversal vulnerability exists in the Atlantis self-hosted Go application, specifically involving inconsistent validation of user-controlled workspace values. This issue affects versions from 0.19.8 up to 0.45.0.\nThe vulnerability allows unvalidated workspace inputs supplied via repository-level atlantis.yaml configuration files or authenticated /api/plan inputs to be concatenated directly into local workspace paths.\nSuccessful exploitation enables attackers to supply traversal segments that escape the intended per-pull workspace directory. Consequently, filesystem operations such as os.RemoveAll and os.MkdirAll are executed on out-of-bounds directories prior to Terraform validation.\nThe impact includes integrity loss and denial of service through the unauthorized creation, deletion, or reuse of arbitrary writable filesystem paths running under the security context and privileges of the Atlantis process.\nAttackers require the capability to supply repository-level configuration or authenticate against the API endpoint to trigger vulnerable workspace code paths.",
  "technicalDetails": "The root cause of the vulnerability stems from the absence of rigorous sanitization and validation of user-supplied workspace identifiers in Atlantis versions 0.19.8 through 0.45.0. When Atlantis processes Terraform pull request events via webhooks, it accepts workspace values defined within repository-level atlantis.yaml configurations or via authenticated /api/plan inputs.\nDuring clone preparation and related working-directory operations, these unvalidated workspace strings—containing relative path traversal sequences—are directly joined with local base directory paths. Because the application fails to strip or reject traversal characters before invoking filesystem utilities, the resulting path points outside the intended per-pull workspace boundary.\nThe attack flow proceeds as follows: First, an attacker supplies a malicious workspace identifier containing directory traversal sequences (such as dot-dot-slash patterns) via an accepted atlantis.yaml file or the /api/plan interface. Second, Atlantis processes the webhook or API request, initiating clone preparation routines. Third, the application concatenates the tainted workspace value into the local path string. Fourth, standard library functions like os.RemoveAll and os.MkdirAll are executed against the out-of-bounds target directory. Finally, these operations occur with the direct privileges of the Atlantis process before Terraform evaluates and rejects the invalid workspace name.\nThe vulnerable components involve the workspace handling and directory provisioning logic within the Atlantis codebase. The affected product is Atlantis, spanning versions 0.19.8 up to and including version 0.44.x, with remediation applied in version 0.45.0.\nAuthentication requirements depend on the injection vector, potentially requiring access to submit pull requests with repository configuration files or authentication to the /api/plan endpoint. The network exposure is tied to the Atlantis webhook listener and API endpoints. Post-exploitation impact is characterized by unauthorized filesystem modification, destruction of arbitrary directories within the process privilege boundary, and localized denial of service."
}