Atlantis Path Traversal Vulnerability: Upgrade to 0.45.0
- Severity
- HIGH
- Affected component
- atlantis (github-actions)
- Patched version
- 0.45.0
An early warning has been issued for a path traversal vulnerability in Atlantis versions >= 0.19.8 and < 0.45.0. This vulnerability allows out-of-bounds directory deletion and creation.
What happened
Atlantis versions >= 0.19.8 and < 0.45.0 reportedly have a path traversal vulnerability in workspace handling. This vulnerability allows out-of-bounds directory deletion and creation. The issue is under investigation and is not yet confirmed as exploited in the wild. Users of affected versions should assess their exposure and take appropriate action.
The vulnerability was first flagged on 2026-08-21T20:55:33+00:00. The issue has been addressed in Atlantis 0.45.0. Users are advised to upgrade to this version or later to mitigate the risk.
What to do about it
- Upgrade to Atlantis 0.45.0 or later to mitigate the path traversal vulnerability.
- Review your Atlantis workspace configurations to ensure they are secure and do not expose sensitive directories.
- Monitor the primary sources for updates on the vulnerability and any additional mitigation steps.
How 0Day would have caught this
atlantis is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Atlantis versions >= 0.19.8 and < 0.45.0.
What should I do right now?
Upgrade to Atlantis 0.45.0 or later to mitigate the path traversal vulnerability.
Is there an official fix available?
Yes, the official fix is available in Atlantis 0.45.0.
Where can I find more information about this vulnerability?
Consult the primary source at https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28 for more information.