CVE-2026-64679 is a high-severity (CVSS 8.1) Path Traversal vulnerability in github.com/runatlantis/atlantis. O3 Security confirms whether CVE-2026-64679 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation
Real-World Exposure
github.com/runatlantis/atlantisReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Atlantis versions >= 0.19.8 and < 0.45.0 did not consistently validate user-controlled workspace values before using them to construct local workspace paths.
A crafted workspace value containing path traversal segments could cause Atlantis to resolve workspace paths outside the intended per-pull workspace directory. In vulnerable versions or code paths, Atlantis could create, use, or remove/recreate out-of-bounds directories with the privileges of the Atlantis process user, before Terraform rejected the invalid workspace name.
The issue is fixed in Atlantis 0.45.0.
Details
The issue is a path traversal vulnerability in Atlantis workspace handling. workspace values can be supplied through repository-level atlantis.yaml configuration accepted by the server or through authenticated API input. A value such as ../../../../../../../../tmp/f1-canary could escape the intended Atlantis workspace root.
In affected code paths, Atlantis used the resolved workspace path for local working-directory operations. For example, workspace values were joined into repo pull paths, and clone preparation paths could call directory removal/recreation operations such as os.RemoveAll and os.MkdirAll on the resolved directory.
PoC
In a local PoC using repo-level atlantis.yaml, the following workspace value caused Atlantis to resolve and use /tmp/f1-canary outside ~/.atlantis/repos/...:
version: 3
projects:
- dir: .
workspace: ../../../../../../../../tmp/f1-canary
Atlantis logs showed the out-of-bounds directory being created and Terraform being run with /tmp/f1-canary as the working directory. Terraform rejected the workspace name only after Atlantis had already used the out-of-bounds path.
Impact
A user who can cause Atlantis to process a crafted workspace value, for example through repository-level atlantis.yaml configuration accepted by the server or an authenticated /api/plan request, may cause filesystem operations to occur outside the intended workspace boundary.
Depending on the affected version, code path, deployment configuration, and filesystem permissions, this may result in unintended directory creation, deletion, or reuse, integrity impact to writable local paths, or denial of service. Containerized deployments may limit host impact, but writable mounted volumes and persistent Atlantis data paths remain relevant.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/runatlantis/atlantis | ≥ 0.19.8&&< 0.45.0 | 0.45.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/runatlantis/atlantis. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update github.com/runatlantis/atlantis to 0.45.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-64679 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-64679 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-64679. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-64679 in your dependencies?
O3 detects CVE-2026-64679 across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.