Threats tagged 'ghsa-92w2-g272-fr77'

CVE-2026-120308 is a critical vulnerability affecting Beta9 tenants who can attach arbitrary volumes when deploying functions, endpoints, or task queues. The issue arises because the gateway improperly constructs host paths for volume mounts without validating ownership or path traversal, allowing tenants to access and modify files outside their workspace, including other tenants' data. This vulnerability was confirmed in gateway version 0.1.769 and worker version 0.1.745 and fixed in gateway 0.1.776 and worker 0.1.756 by adding validation of volume identifiers and mount paths.