CVE-2026-127075: OpsTree BuildPiper before 2.7.0 Path Traversal via Additional Manifest Rendering
OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying traversal sequences in Additional Manifest file paths. Attackers can enter paths like ../../../../etc/passwd so the renderer embeds file contents in generated manifests and logs, exposing configuration files and service-account tokens.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated BuildPiper user who can supply Additional Manifest file paths can exploit the traversal. The attack can be performed remotely and does not require user interaction.
What information could be exposed?
An attacker can cause arbitrary readable files to be embedded in generated manifests and logs. This may expose configuration files and service-account tokens.
Are deployments running version 2.7.0 affected?
The issue is described as affecting OpsTree BuildPiper versions before 2.7.0. Version 2.7.0 is not identified as affected in the provided data.