Description

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-12T15:18:20.083Z",
  "pubdate": "2026-08-12T15:18:20.083Z",
  "executiveSummary": "An authorization and path restriction bypass vulnerability exists within the repository reader component when utilizing cache-deploy permissions. This security flaw allows an authenticated actor with specific repository reading capabilities to bypass enforced boundary constraints and access sensitive files, directories, or system content located outside of the designated upstream path configuration.\nThe vulnerability introduces significant risk to confidentiality and integrity by exposing resources that should be strictly isolated to authorized upstream directories. Successful exploitation grants attackers unauthorized read access to out-of-bounds filesystem locations, potentially leading to the disclosure of sensitive configuration data, internal application logic, or adjacent repository assets.\nThe attacker capabilities are constrained to those holding a repository reader role combined with cache-deploy permission. Exploitation relies on specific structural conditions within the request handling logic where path sanitization or validation mechanisms fail to properly neutralize traversal sequences or validate absolute paths against the intended upstream boundary before fulfilling the read operation.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and boundary enforcement within the path resolution logic of the repository reader component. When a user with cache-deploy permission interacts with the reader, the underlying system fails to adequately sanitize path inputs or canonicalize target paths against the configured upstream directory root.\nThe vulnerable component is responsible for translating incoming read requests into filesystem operations or upstream retrieval actions. Due to the lack of strict lexical analysis or chroot-like containment, specially crafted requests containing relative traversal sequences or absolute path identifiers can trick the resolution engine into traversing upward past the intended directory boundary.\nThe attack flow proceeds as follows: First, the malicious actor authenticates with a role that possesses both repository reader and cache-deploy permissions. Second, the actor crafts a targeted request containing path manipulation syntax designed to escape the configured upstream path. Third, the repository reader processes the request without enforcing proper boundary checks, resolving the path to a location outside the intended storage root. Finally, the system reads and returns the contents of the out-of-bounds target back to the attacker, resulting in unauthorized data exposure.\nExploitation requires specific preconditions, including the possession of valid credentials with cache-deploy permission and repository reading rights. The network exposure corresponds to the standard interface exposed by the repository reader service. Post-exploitation impact includes the potential leakage of sensitive system files, application secrets, or other protected repositories residing on the same underlying filesystem structure."
}