{"id":"CVE-2026-127075","kind":"vulnerability","aliases":["CVE-2026-127075"],"related":[],"title":"OpsTree BuildPiper: path traversal lets logged-in users read arbitrary files","description":"OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying traversal sequences in Additional Manifest file paths. Attackers can enter paths like ../../../../etc/passwd so the renderer embeds file contents in generated manifests and logs, exposing configuration files and service-account tokens.","summary":"OpsTree BuildPiper before 2.7.0 lets an authenticated user supply traversal sequences in Additional Manifest file paths, so the renderer reads files outside the intended directory. The file contents are embedded in generated manifests and logs, exposing configuration files and service-account tokens.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["buildpiper","ci-cd","kubernetes","other"],"not_affected_if":["already-on-2.7.0","no-buildpiper"],"how_to_check":"- Check the installed BuildPiper version; versions before `2.7.0` are in the affected range.\n- Review whether any user can set Additional Manifest file paths in BuildPiper.","fix":"- BuildPiper: upgrade to `2.7.0` or later.","status":"open","published_at":"2026-11-13T10:18:03+00:00","first_seen_at":"2026-11-13T10:47:28+00:00","triaged_at":"2026-11-13T10:52:53+00:00","updated_at":"2026-11-13T10:52:53+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T10:52:53Z","model":"claude-haiku-5-5","output":{"fix":"- BuildPiper: upgrade to `2.7.0` or later.","reach":"network","title":"OpsTree BuildPiper: path traversal lets logged-in users read arbitrary files","impact":"high","summary":"OpsTree BuildPiper before 2.7.0 lets an authenticated user supply traversal sequences in Additional Manifest file paths, so the renderer reads files outside the intended directory. The file contents are embedded in generated manifests and logs, exposing configuration files and service-account tokens.","audience":"businesses","category":"other","nicknames":[],"who_cares":["buildpiper","kubernetes","ci-cd"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker reads server files and service-account tokens","analyst_note":"","how_to_check":"- Check the installed BuildPiper version; versions before `2.7.0` are in the affected range.\n- Review whether any user can set Additional Manifest file paths in BuildPiper.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["already-on-2.7.0","no-buildpiper"],"who_is_affected":"Teams that run OpsTree BuildPiper below 2.7.0 where users can enter Additional Manifest file paths. The flaw requires a logged-in account, so exposure depends on who holds accounts on the instance. Instances without BuildPiper, or already on 2.7.0 or later, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000729,"input_tokens":4604,"output_tokens":538,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-127075':15A,18A '-2026':14A,17A '/../../../etc/passwd':98C '2.7.0':27B,70C 'account':65B,116C 'addit':36B,89C 'allow':77C 'arbitrari':11A,82C 'attack':93C 'authent':30B,78C 'buildpip':2A,19B,25B,68C 'cd':22B 'ci':21B 'ci-cd':20B 'configur':60B,111C 'contain':71C 'content':51B,104C 'cve':13A,16A 'directori':48B 'emb':102C 'embed':53B 'enter':95C 'expos':59B,110C 'file':12A,38B,44B,50B,61B,83C,91C,103C,112C 'generat':55B,106C 'intend':47B 'kubernet':23B 'let':5A,28B 'like':97C 'log':7A,58B,109C 'logged-in':6A 'manifest':37B,56B,90C,107C 'opstre':1A,24B,67C 'outsid':45B 'path':3A,39B,73C,92C,96C 'read':10A,43B,81C 'render':42B,101C 'sequenc':34B,87C 'servic':64B,115C 'service-account':63B,114C 'suppli':32B,85C 'token':66B,117C 'travers':4A,33B,74C,86C 'user':9A,31B,79C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Teams that run OpsTree BuildPiper below 2.7.0 where users can enter Additional Manifest file paths. The flaw requires a logged-in account, so exposure depends on who holds accounts on the instance. Instances without BuildPiper, or already on 2.7.0 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["buildpiper","cicd","high","kubernetes","other"],"campaign_type":null,"search_a":"'-127075':15A,18A '-2026':14A,17A 'arbitrari':11A 'buildpip':2A 'cve':13A,16A 'file':12A 'let':5A 'log':7A 'logged-in':6A 'opstre':1A 'path':3A 'read':10A 'travers':4A 'user':9A","search_b":"'2.7.0':27B 'account':65B 'addit':36B 'authent':30B 'buildpip':19B,25B 'cd':22B 'ci':21B 'ci-cd':20B 'configur':60B 'content':51B 'directori':48B 'embed':53B 'expos':59B 'file':38B,44B,50B,61B 'generat':55B 'intend':47B 'kubernet':23B 'let':28B 'log':58B 'manifest':37B,56B 'opstre':24B 'outsid':45B 'path':39B 'read':43B 'render':42B 'sequenc':34B 'servic':64B 'service-account':63B 'suppli':32B 'token':66B 'travers':33B 'user':31B","search_c":"'/../../../etc/passwd':98C '2.7.0':70C 'account':116C 'addit':89C 'allow':77C 'arbitrari':82C 'attack':93C 'authent':78C 'buildpip':68C 'configur':111C 'contain':71C 'content':104C 'emb':102C 'enter':95C 'expos':110C 'file':83C,91C,103C,112C 'generat':106C 'like':97C 'log':109C 'manifest':90C,107C 'opstre':67C 'path':73C,92C,96C 'read':81C 'render':101C 'sequenc':87C 'servic':115C 'service-account':114C 'suppli':85C 'token':117C 'travers':74C,86C 'user':79C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:18:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127075","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127075","severity":null,"published_at":"2026-11-13T10:18:03+00:00","modified_at":"2026-11-13T10:18:03+00:00","first_seen_at":"2026-11-13T10:47:28+00:00","fetched_at":"2026-11-13T10:47:28+00:00","note":null}],"documents":[{"id":145279,"url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-path-traversal-via-additional-manifest-rendering","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}