Listen to this Post
CVE-2026-71493 is a path traversal vulnerability affecting the Infracost config-template parser prior to version 0.10.45. The flaw resides in four template functions—readFile, pathExists, isDir, and matchPaths—which are used to process file paths supplied by a repository. These functions perform a lexical check using `filepath.Rel` and a leaf-only `os.Lstat` verification to confirm that a path stays within the intended directory. However, this validation does not resolve intermediate symbolic links. An attacker can commit a repository containing a directory symlink that points outside the checkout, such as evil -> /. When a template expression like `{{ readFile “evil/file” }}` is evaluated, the path appears lexically clean and the leaf file passes the `os.Lstat` check, but `os.ReadFile` follows the symlink and reads files outside the restricted directory.
The content retrieved is then rendered into the generated Infracost configuration and surfaced through the Infracost dashboard or as a comment on a pull request. This means any user who can open a pull request can potentially read arbitrary files accessible to the CI runner. The impact is heightened when Infracost runs under the `pull_request_target` trigger or on a same-repository pull request, as the runner may have access to repository secrets. In such cases, an attacker could exfiltrate these secrets. The issue was fixed in version 0.10.45 by routing all four affected functions through security.IsPathAllowed, which resolves symlinks at every path segment before performing a containment check.
DailyCVE Form:
Platform: Infracost CLI
Version: < 0.10.45
Vulnerability: Path Traversal
Severity: Medium (CVSS 5.9)
Date: 2026-08-21
Prediction: Already patched (v0.10.45)
What Undercode Say:
The vulnerability centers on the `internal/config/template/parser.go` file. The fix introduced the `security.IsPathAllowed` function to properly resolve symlinks. The following commands can be used to check the version and upgrade:
Check current Infracost version infracost --version Upgrade to the patched version using the official script curl -fsSL https://raw.githubusercontent.com/infracost/infracost/master/scripts/install.sh | sh -s -- -b /usr/local/bin v0.10.45 Or upgrade via a package manager (e.g., Homebrew) brew upgrade infracost Verify the upgrade infracost --version
Exploit: (Educational Purposes!)
A malicious repository can be crafted with a symlink pointing outside the checkout:
Create a symlink in the repository that points to the root directory
ln -s / evil
Create a template file that reads a sensitive file via the symlink
echo '{{ readFile "evil/etc/passwd" }}' > infracost.tmpl
When Infracost processes this template, it will read /etc/passwd
and display it in the output
Protection:
- Upgrade to Infracost version v0.10.45 or later.
- If an immediate upgrade is not possible, run Infracost under `on: pull_request` instead of
pull_request_target, and ensure fork pull requests do not receive secrets (this is the default behavior).
Impact:
Successful exploitation allows an attacker to read any file that the Infracost CLI process can access on the runner. In CI/CD environments, this could lead to the disclosure of repository secrets, tokens, or other sensitive configuration data if the workflow runs with elevated permissions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
