CVE-2026-64679

### Summary Atlantis versions `>= 0.19.8` and `< 0.45.0` did not consistently validate user-controlled `workspace` values before using them to construct local workspace paths. A crafted workspace value containing path traversal segments could cause Atlantis to resolve workspace paths outside the intended per-pull workspace directory. In vulnerable versions or code paths, Atlantis could create, use, or remove/recreate out-of-bounds directories with the privileges of the Atlantis process user, before Terraform rejected the invalid workspace name. The issue is fixed in Atlantis `0.45.0`. ### Details The issue is a path traversal vulnerability in Atlantis workspace handling. `workspace` values can be supplied through repository-level `atlantis.yaml` configuration accepted by the server or through authenticated API input. A value such as `../../../../../../../../tmp/f1-canary` could escape the intended Atlantis workspace root. In affected code paths, Atlantis used the resolved workspace path for local working-directory operations. For example, workspace values were joined into repo pull paths, and clone preparation paths could call directory removal/recreation operations such as `os.RemoveAll` and `os.MkdirAll` on the resolved directory. ### PoC In a local PoC using repo-level `atlantis.yaml`, the following workspace value caused Atlantis to resolve and use `/tmp/f1-canary` outside `~/.atlantis/repos/...`: ```yaml version: 3 projects: - dir: . workspace: ../../../../../../../../tmp/f1-canary ``` Atlantis logs showed the out-of-bounds directory being created and Terraform being run with `/tmp/f1-canary` as the working directory. Terraform rejected the workspace name only after Atlantis had already used the out-of-bounds path. ### Impact A user who can cause Atlantis to process a crafted `workspace` value, for example through repository-level `atlantis.yaml` configuration accepted by the server or an authenticated `/api/plan` request, may cause filesystem ope