GO-2026-6273

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-6273

Import Source

https://vuln.go.dev/ID/GO-2026-6273.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-6273

Aliases

Downstream

CGA-578x-4cvp-97hc

Published

2026-08-25T15:00:08Z

Modified

2026-08-25T23:51:38Z

Summary

Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation in github.com/runatlantis/atlantis

Details

Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation in github.com/runatlantis/atlantis

Database specific

{
    "review_status": "UNREVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6273"
}

References

Affected packages

Go / github.com/runatlantis/atlantis

Package

Name: github.com/runatlantis/atlantis; View open source insights on deps.dev
Purl: pkg:golang/github.com/runatlantis/atlantis

Affected ranges

Type: SEMVER
Events: Introduced

0.19.8

Fixed

0.45.0

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/runatlantis/atlantis/server/events",
            "symbols": [
                "DefaultProjectCommandRunner.Apply",
                "DefaultProjectCommandRunner.Import",
                "DefaultProjectCommandRunner.Plan",
                "DefaultProjectCommandRunner.PolicyCheck",
                "DefaultProjectCommandRunner.StateRm",
                "DefaultProjectCommandRunner.Version",
                "DefaultProjectCommandRunner.doApply",
                "DefaultProjectCommandRunner.doImport",
                "DefaultProjectCommandRunner.doPlan",
                "DefaultProjectCommandRunner.doPolicyCheck",
                "DefaultProjectCommandRunner.doStateRm",
                "DefaultProjectCommandRunner.doVersion",
                "EventParser.ParseAPIPlanRequest",
                "EventParser.ParseAzureDevopsPull",
                "EventParser.ParseAzureDevopsPullEvent",
                "EventParser.ParseAzureDevopsRepo",
                "EventParser.ParseBitbucketCloudPullCommentEvent",
                "EventParser.ParseBitbucketCloudPullEvent",
                "EventParser.ParseBitbucketServerPullCommentEvent",
                "EventParser.ParseBitbucketServerPullEvent",
                "EventParser.ParseGiteaIssueCommentEvent",
                "EventParser.ParseGiteaPull",
                "EventParser.ParseGiteaPullRequestEvent",
                "EventParser.ParseGiteaRepo",
                "EventParser.ParseGithubIssueCommentEvent",
                "EventParser.ParseGithubPull",
                "EventParser.ParseGithubPullEvent",
                "EventParser.ParseGithubRepo",
                "EventParser.ParseGitlabMergeRequestCommentEvent",
                "EventParser.ParseGitlabMergeRequestEvent",
                "FileWorkspace.Clone",
                "FileWorkspace.Delete",
                "FileWorkspace.DeleteForWorkspace",
                "FileWorkspace.DeletePlan",
                "FileWorkspace.GetGitUntrackedFiles",
                "FileWorkspace.GetPullDir",
                "FileWorkspace.GetWorkingDir",
                "FileWorkspace.GitReadLock",
                "FileWorkspace.MergeAgain",
                "FileWorkspace.cloneDir",
                "FileWorkspace.repoPullDir",
                "FileWorkspace.validateCloneDir"
            ]
        },
        {
            "path": "github.com/runatlantis/atlantis/server/core/config/raw",
            "symbols": [
                "Project.Validate"
            ]
        },
        {
            "path": "github.com/runatlantis/atlantis/server/events/models",
            "symbols": [
                "NewRepo"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6273.json"