Description

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-10T16:18:12.120Z",
  "pubdate": "2026-09-10T16:18:12.120Z",
  "executiveSummary": "The vulnerability is identified as a Path Traversal issue within the /api/opencode proxy endpoint, affecting all versions of the product prior to 0.31.0. The security flaw stems from insufficient validation of user-supplied input provided via the x-opencode-directory request header. By failing to sanitize or restrict this input, the application allows remote, unauthenticated attackers to manipulate file system operations beyond the intended project root directory.\nThe impact of this vulnerability is significant, as it grants attackers the ability to perform arbitrary file system operations, including reading, writing, or potentially deleting files on the host system depending on the application's service account permissions. This represents a critical risk to data confidentiality and integrity. Successful exploitation requires network access to the API endpoint and does not necessitate prior authentication, making the system highly vulnerable to remote compromise. Immediate remediation through upgrading to version 0.31.0 or higher is required to close the security gap and prevent unauthorized host system access.",
  "technicalDetails": "The vulnerability is located within the proxy handling logic of the /api/opencode endpoint. The root cause is an improper input validation mechanism applied to the x-opencode-directory HTTP header. Instead of enforcing a strict whitelist or performing path canonicalization to ensure file operations are confined to a designated project root directory, the application accepts the raw string provided by the client.\nExploitation is achieved through the use of path traversal sequences (e.g., '../') embedded within the x-opencode-directory header. When the proxy receives a request, it concatenates the unsanitized header value with the base path of the project. Because the application logic does not neutralize directory traversal characters, the resultant path points to locations outside the intended application directory structure. This allows an attacker to navigate the host filesystem tree.\nThe attack flow follows a predictable pattern: 1) The attacker identifies the /api/opencode endpoint and prepares a request containing a malicious x-opencode-directory header. 2) The attacker injects traversal sequences into this header to target sensitive files or directories, such as configuration files, credential stores, or system files. 3) The backend processes the request and executes file operations using the manipulated path. 4) The application returns the results of these operations (such as file contents or confirmation of file modification) back to the attacker.\nThe component responsible for this flaw is the proxy service that interfaces with the filesystem. Since the vulnerability resides at the API level, the exposure is network-based, meaning any party capable of routing traffic to the API can attempt exploitation. No specific authentication tokens are typically required to reach the vulnerable code path, significantly lowering the barrier to entry for an adversary. Post-exploitation, the attacker may gain read access to sensitive host data, perform unauthorized modifications to existing files, or leverage the write capability to place malicious scripts if the service account allows for it. The lack of input validation essentially bypasses the intended security boundaries, effectively granting the attacker the privileges of the application's user account on the underlying operating system."
}