{"id":"CVE-2026-127074","kind":"vulnerability","aliases":["CVE-2026-127074"],"related":[],"title":"OpsTree BuildPiper: path traversal lets build users read worker files","description":"OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build configuration permission to read files on the build worker by supplying unvalidated dockerfile_path and build context values. Attackers can set traversal or absolute paths such as /etc/passwd via the CI configuration endpoint, then trigger a build to disclose file contents in the build log.","summary":"OpsTree BuildPiper before 2.7.0 does not validate the dockerfile_path and build context values, so a user can point a build at paths like /etc/passwd. Triggering the build then writes the file contents into the build log, which the attacker can read.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["buildpiper","ci-cd","self-hosted","vendor"],"not_affected_if":["no-build-config-permission-users","version-2.7.0-or-later"],"how_to_check":"- Check the installed BuildPiper version; unknown whether a specific command reports it\n- Review whether untrusted users hold build configuration permission in BuildPiper","fix":"- BuildPiper: move to `2.7.0` or later (per the advisory's affected range)","status":"open","published_at":"2026-11-13T10:18:03+00:00","first_seen_at":"2026-11-13T10:47:28+00:00","triaged_at":"2026-11-13T10:57:08+00:00","updated_at":"2026-11-13T10:57:08+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-13T10:57:08Z","model":"claude-haiku-5-5","output":{"fix":"- BuildPiper: move to `2.7.0` or later (per the advisory's affected range)","reach":"network","title":"OpsTree BuildPiper: path traversal lets build users read worker files","impact":"medium","summary":"OpsTree BuildPiper before 2.7.0 does not validate the dockerfile_path and build context values, so a user can point a build at paths like /etc/passwd. Triggering the build then writes the file contents into the build log, which the attacker can read.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["buildpiper","ci-cd","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated users read arbitrary files on the build worker","analyst_note":"Confirm the fixed version and any workaround from the NVD entry or the OpsTree vendor advisory; the sources here name only 2.7.0 and the CVSS score.","how_to_check":"- Check the installed BuildPiper version; unknown whether a specific command reports it\n- Review whether untrusted users hold build configuration permission in BuildPiper","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-2.7.0-or-later","no-build-config-permission-users"],"who_is_affected":"Teams running OpsTree BuildPiper before 2.7.0 where users have build configuration permission. Exposure depends on whether those users can set the dockerfile_path and build context values and read build logs. Instances already on 2.7.0 or later are not affected by this flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000748,"input_tokens":4608,"output_tokens":574,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127074':13A,16A '-2026':12A,15A '/etc/passwd':49B,109C '2.7.0':28B,70C 'absolut':105C 'allow':77C 'attack':64B,100C 'authent':78C 'build':6A,36B,45B,52B,60B,81C,89C,97C,118C,125C 'buildpip':2A,17B,26B,68C 'cd':20B 'ci':19B,112C 'ci-cd':18B 'configur':82C,113C 'contain':71C 'content':57B,122C 'context':37B,98C 'cve':11A,14A 'disclos':120C 'dockerfil':33B,94C 'endpoint':114C 'file':10A,56B,86C,121C 'host':23B 'let':5A 'like':48B 'log':61B,126C 'opstre':1A,25B,67C 'path':3A,34B,47B,73C,95C,106C 'permiss':83C 'point':43B 'read':8A,66B,85C 'self':22B 'self-host':21B 'set':102C 'suppli':92C 'travers':4A,74C,103C 'trigger':50B,116C 'unvalid':93C 'user':7A,41B,79C 'valid':31B 'valu':38B,99C 'vendor':24B 'via':110C 'vulner':75C 'worker':9A,90C 'write':54B","nicknames":[],"mitigations":[],"who_affected":"Teams running OpsTree BuildPiper before 2.7.0 where users have build configuration permission. Exposure depends on whether those users can set the dockerfile_path and build context values and read build logs. Instances already on 2.7.0 or later are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["buildpiper","cicd","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-127074':13A,16A '-2026':12A,15A 'build':6A 'buildpip':2A 'cve':11A,14A 'file':10A 'let':5A 'opstre':1A 'path':3A 'read':8A 'travers':4A 'user':7A 'worker':9A","search_b":"'/etc/passwd':49B '2.7.0':28B 'attack':64B 'build':36B,45B,52B,60B 'buildpip':17B,26B 'cd':20B 'ci':19B 'ci-cd':18B 'content':57B 'context':37B 'dockerfil':33B 'file':56B 'host':23B 'like':48B 'log':61B 'opstre':25B 'path':34B,47B 'point':43B 'read':66B 'self':22B 'self-host':21B 'trigger':50B 'user':41B 'valid':31B 'valu':38B 'vendor':24B 'write':54B","search_c":"'/etc/passwd':109C '2.7.0':70C 'absolut':105C 'allow':77C 'attack':100C 'authent':78C 'build':81C,89C,97C,118C,125C 'buildpip':68C 'ci':112C 'configur':82C,113C 'contain':71C 'content':122C 'context':98C 'disclos':120C 'dockerfil':94C 'endpoint':114C 'file':86C,121C 'log':126C 'opstre':67C 'path':73C,95C,106C 'permiss':83C 'read':85C 'set':102C 'suppli':92C 'travers':74C,103C 'trigger':116C 'unvalid':93C 'user':79C 'valu':99C 'via':110C 'vulner':75C 'worker':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:18:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127074","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127074","severity":null,"published_at":"2026-11-13T10:18:03+00:00","modified_at":"2026-11-13T10:18:03+00:00","first_seen_at":"2026-11-13T10:47:28+00:00","fetched_at":"2026-11-13T10:47:28+00:00","note":null}],"documents":[{"id":145278,"url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-path-traversal-via-dockerfile-path-and-build-context","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}