CVE-2023-22726: act project act

csirt@kutim:~/threat-intel/cve/CVE-2023-22726

CVSS 8.8 · High EPSS 1,3%

Kerentanan Unrestricted Upload of File with Dangerous Type pada act project act. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege escalation. The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open. The /artifact endpoint is vulnerable to path traversal as the path is variable is user controlled, and the specified file is ultimately returned by the server. This has been addressed in version 0.2.40. Users are advised to upgrade. Users unable to upgrade may, during implementation of Open and OpenAtEnd for FS, ensure to use ValidPath() to check against path traversal or clean the user-provided paths manually.

Rincian

Terbit di NVD: 20 Januari 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-434: Unrestricted Upload of File with Dangerous Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 1,3% peluang dieksploitasi; lebih tinggi dari 68,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
act project	act	Semua versi sebelum 0.2.40

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10 patch · advisory pihak ketiga
https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65 advisory pihak ketiga
https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245 advisory pihak ketiga
https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2 advisory pihak ketiga
https://github.com/nektos/act/issues/1553 issue tracking · advisory pihak ketiga
https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff exploit · advisory pihak ketiga
https://securitylab.github.com/advisories/GHSL-2023-004_act/ exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.