CVE-2026-47680

CVE-2026-47680 is a path traversal vulnerability in FluxCD source-controller (versions 0.0.17 through 1.8.4), a Kubernetes operator for artifact acquisition from Git, OCI, Helm, and S3 sources. Two attack surfaces exist: (1) an actor who can influence the contents of a Bucket-referenced bucket ca...

CVE-2026-47680: Relative Path Traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

Source controller: Improper path handling allows traversal

Impact An actor with the ability to influence the contents of a bucket referenced by a Bucket resource can cause source-controller to write fetched object data to paths outside the per-reconciliation working directory. The corruption surface is bounded by source-controller's own and downstream Fl...