-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper workspace path handling. Key functions identified: 1) createProcess in convert.go - originally used user-defined workspace base for plugins, allowing overwriting of entrypoint executables via path traversal. 2) stepWorkingDir - combined user-controlled paths without plugin-specific sanitization. 3) WithWorkspace in option.go - set vulnerable path values. The patch introduced path.Clean, enforced fixed pluginWorkspaceBase, and separated plugin/non-plugin path handling, confirming these were the vulnerable points.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| go.woodpecker-ci.org/woodpecker/v2 | go | < 2.7.0 | 2.7.0 |
| go.woodpecker-ci.org/woodpecker | go | < 2.7.0 | 2.7.0 |