CVE-2026-120307

{
  "etk_id": "ETK-2026-3228",
  "cve_id": "CVE-2026-120307",
  "display_id": "CVE-2026-120307",
  "ghsa_id": "GHSA-6h4h-qffc-3gfp",
  "euvd_id": "EUVD-2026-114841",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal and symlink escape in Beta9 worker file API",
  "summary": "Beta9 worker versions before 0.1.756 can fail to confine sandbox file API requests to the intended container or mounted storage paths. An authenticated tenant may read, modify, enumerate, or remove files on the worker host. Exploitation requires a workspace token and a running sandbox.",
  "mitigation": "Upgrade github.com/beam-cloud/beta9 workers to version 0.1.756 or later. Until upgraded, restrict untrusted workspace access and isolate workers from sensitive host and cluster credentials.",
  "vendor": "beam-cloud",
  "product": "Beta9 worker",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 0.1.756"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "0.1.756"
      ],
      "package_name": "github.com/beam-cloud/beta9",
      "purl": null
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 9.9,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 37.215521433333336,
  "t0_at": "2026-11-01T12:49:51.981000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-01T13:45:45.065087+00:00",
      "days": 0.038808843599537034,
      "is_lower_bound": false,
      "measured_at": "2026-11-01T12:49:51.981000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-01T12:49:51.981000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-01T12:49:51.981000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-120307"
    }
  }
}