---
id: "CVE-2026-127075"
page: "https://infrastack.ai/live/CVE-2026-127075"
kind: "vulnerability"
aliases: ["CVE-2026-127075"]
title: "OpsTree BuildPiper: path traversal lets logged-in users read arbitrary files"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["buildpiper", "ci-cd", "kubernetes", "other"]
not_affected_if: ["already-on-2.7.0", "no-buildpiper"]
published_at: "2026-11-13T10:18:03+00:00"
first_seen_at: "2026-11-13T10:47:28+00:00"
updated_at: "2026-11-13T10:52:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127075", "first_seen_at": "2026-11-13T10:47:28+00:00"}]
exploit_sources: []
---

# OpsTree BuildPiper: path traversal lets logged-in users read arbitrary files

Link for people: https://infrastack.ai/live/CVE-2026-127075 (this .md is for agents)

OpsTree BuildPiper before 2.7.0 lets an authenticated user supply traversal sequences in Additional Manifest file paths, so the renderer reads files outside the intended directory. The file contents are embedded in generated manifests and logs, exposing configuration files and service-account tokens.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed BuildPiper version; versions before `2.7.0` are in the affected range.
- Review whether any user can set Additional Manifest file paths in BuildPiper.

## Fix

- BuildPiper: upgrade to `2.7.0` or later.

## Timeline

- 2026-11-13T10:47:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127075

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-path-traversal-via-additional-manifest-rendering

## From the sources

OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying traversal sequences in Additional Manifest file paths. Attackers can enter paths like ../../../../etc/passwd so the renderer embeds file contents in generated manifests and logs, exposing configuration files and service-account tokens.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_