CVE-2026-127074

Description

OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build configuration permission to read files on the build worker by supplying unvalidated dockerfile_path and build context values. Attackers can set traversal or absolute paths such as /etc/passwd via the CI configuration endpoint, then trigger a build to disclose file contents in the build log.

References

• https://gist.github.com/neelkotnis/58e88fa3decf9e0145bf28a4b61a394a
• https://www.buildpiper.io/
• https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-path-traversal-via-dockerfile-path-and-build-context