CVE-2026-64679

Name of the Vulnerable Software and Affected Versions Atlantis versions 0.19.8 through 0.44.0

Description Atlantis fails to consistently validate user-controlled workspace values provided via the repository-level atlantis.yaml configuration or the authenticated '/api/plan' endpoint before joining them into local workspace paths. This allows traversal segments to escape the intended per-pull workspace directory. Consequently, clone preparation or other working-directory processes may execute filesystem operations such as os.RemoveAll() or os.MkdirAll() on directories outside the intended scope using the privileges of the Atlantis process. This can lead to the creation, deletion, or reuse of writable paths, resulting in integrity loss or denial of service.

Recommendations Update to version 0.45.0.