Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated /api/plan input before joining them into local workspace paths. Traversal segments can escape the intended per-pull workspace directory and cause clone preparation or other working-directory code paths to call os.RemoveAll, os.MkdirAll, or related filesystem operations on out-of-bounds directories before Terraform rejects the invalid workspace name. This can create, delete, or reuse writable paths with the privileges of the Atlantis process, causing integrity loss or denial of service. This issue is fixed in version 0.45.0.

A path traversal vulnerability exists in Atlantis, a self-hosted Go application for Terraform pull request automation, affecting versions 0.19.8 through 0.44.x. The flaw stems from insufficient validation of user-controlled workspace values provided via repository-level atlantis.yaml configuration or the authenticated /api/plan endpoint. Malicious traversal segments can escape the intended workspace directory, causing filesystem operations such as os.RemoveAll and os.MkdirAll to be executed on unintended directories. These operations run with the full privileges of the Atlantis process, enabling attackers to create, delete, or manipulate arbitrary directories. The impact includes integrity loss and potential denial of service. The vulnerability requires either repository-level access (to modify atlantis.yaml) or authenticated API access, limiting the attack surface but not eliminating risk. The issue has been patched in Atlantis version 0.45.0. Users are advised to upgrade immediately to mitigate the risk.