Directory Traversal Vulnerability in GitHub Workflows by Black Lantern Security

CVE-2026-12567

What is CVE-2026-12567?

The github_workflows module has a vulnerability that allows local attackers to exploit the construction of local directory paths from user-controlled repository names. By failing to validate for symlinks, an attacker can create a symlink at a predictable output path. This can result in unauthorized data being written to a directory of the attacker's choosing, potentially compromising the integrity and confidentiality of workflow data.

References