CVE-2026-47680: CWE-23: Relative Path Traversal in fluxcd source-controller

The source-controller component of fluxcd, which manages artifact acquisition from external sources, suffers from a relative path traversal vulnerability (CWE-23) in versions 0.0.17 through 1.8.4. An attacker able to influence the contents of a bucket referenced by a Bucket resource can cause the controller to write fetched data outside its per-reconciliation working directory. Although digest verification by source-controller and downstream controllers limits the impact by preventing manipulated artifacts from reaching the cluster, the attacker can still write arbitrary files wherever the pod has write permissions. Separately, from version 1.6.0, the sparse-checkout feature in GitRepository resources allows limited file path enumeration on the controller pod by users with permission to create or update these resources. The vulnerability was addressed in source-controller version 1.8.5. No in-product workaround is available, but deploying a ValidatingAdmissionPolicy or third-party policy engine to restrict sparseCheckout entries can help mitigate the enumeration risk.

An attacker with the ability to influence bucket contents can write files outside the intended directory on the source-controller pod, potentially leading to unauthorized file writes within the pod's filesystem. However, digest verification prevents manipulated artifacts from being deployed to the cluster, limiting the risk of cluster compromise. Additionally, users with permission to create or update GitRepository resources can enumerate file paths on the controller pod, which may aid further attacks. There are no known exploits in the wild.

A fixed version of source-controller (v1.8.5) is available and users should upgrade to this version to remediate the vulnerability. There is no in-product workaround. As a defense-in-depth measure against the GitRepository sparse-checkout enumeration, administrators can deploy a ValidatingAdmissionPolicy or third-party policy engines like Kyverno or OPA Gatekeeper to reject GitRepository resources with sparseCheckout entries containing '..' or absolute path segments.