CVE-2026-127074: OpsTree BuildPiper before 2.7.0 Path Traversal via Dockerfile Path and Build Context
OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build configuration permission to read files on the build worker by supplying unvalidated dockerfilepath and build context values. Attackers can set traversal or absolute paths such as /etc/passwd via the CI configuration endpoint, then trigger a build to disclose file contents in the build log.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpsTree BuildPiperto a version that resolves this vulnerability.Fixed in 2.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated account with permission to modify build configuration. They must be able to submit dockerfile_path or build context values through the CI configuration endpoint and trigger a build.
What systems and data are exposed?
Build workers are exposed because the supplied paths are resolved on the worker. An attacker can use traversal sequences or absolute paths, such as /etc/passwd, to read files whose contents are emitted to the build log.
Are default deployments affected?
The provided information does not state whether the vulnerable path handling is enabled or reachable in a default deployment. Exposure depends on whether users with build configuration permission can set the Dockerfile path or build context and run builds.
How can I determine whether exploitation may have occurred?
Review CI configuration changes for dockerfile_path or build context values containing traversal sequences or absolute filesystem paths. Review build logs for unexpected contents of files from the build worker.
What can be done if upgrading is not immediately possible?
Restrict build configuration permission to trusted users and prevent untrusted users from setting Dockerfile path or build context values. Monitor configuration changes and build logs for traversal or absolute-path inputs.