Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-64679 · Microsoft / collected KEV context

EUVD-2026-64142

GHSA-26w5-6g95-gj28

GO-2026-6273

cve-program · CVE-2026-64679

• https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28
• https://github.com/runatlantis/atlantis/pull/6254
• https://github.com/runatlantis/atlantis/commit/ea4e4ceebf8b387d015fff7ed8a7fcca33279afe
• https://github.com/runatlantis/atlantis/releases/tag/v0.45.0

euvd · EUVD-2026-64142

• https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28
• https://github.com/runatlantis/atlantis/pull/6254
• https://github.com/runatlantis/atlantis/commit/ea4e4ceebf8b387d015fff7ed8a7fcca33279afe
• https://github.com/runatlantis/atlantis/releases/tag/v0.45.0

nvd · CVE-2026-64679

• https://github.com/runatlantis/atlantis/commit/ea4e4ceebf8b387d015fff7ed8a7fcca33279afe
• https://github.com/runatlantis/atlantis/pull/6254
• https://github.com/runatlantis/atlantis/releases/tag/v0.45.0
• https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28

osv · GHSA-26w5-6g95-gj28

• https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28
• https://github.com/runatlantis/atlantis/pull/6254
• https://github.com/runatlantis/atlantis/commit/ea4e4ceebf8b387d015fff7ed8a7fcca33279afe
• https://github.com/runatlantis/atlantis
• https://github.com/runatlantis/atlantis/releases/tag/v0.45.0

osv · GO-2026-6273

• https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28
• https://github.com/runatlantis/atlantis/commit/ea4e4ceebf8b387d015fff7ed8a7fcca33279afe
• https://github.com/runatlantis/atlantis/pull/6254
• https://github.com/runatlantis/atlantis/releases/tag/v0.45.0

No related operational record is retained in the current change model.