CVE-2026-45224: Crabbox Path Traversal Vulnerability

CVE-2026-45224 Overview

CVE-2026-45224 is a path traversal vulnerability [CWE-22] in Crabbox versions prior to 0.9.0. The flaw resides in the Islo provider's workspace path resolution logic. An attacker can craft a malicious .crabbox.yaml or crabbox.yaml file containing absolute or relative paths with traversal sequences. The resolved path escapes the intended /workspace directory. When sync.delete is enabled, the workspace preparation logic executes rm -rf and mkdir -p against the attacker-controlled path, leading to arbitrary file deletion and directory overwrite outside the sandbox boundary.

Critical Impact
Arbitrary file deletion and overwrite on the host filesystem through unsanitized workspace path resolution combined with destructive rm -rf execution.

Affected Products

Crabbox versions before 0.9.0
Islo provider workspace resolution component (internal/providers/islo/backend.go)
Islo provider sync logic (internal/providers/islo/sync.go)

Discovery Timeline

2026-05-11 - CVE-2026-45224 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-45224

Vulnerability Analysis

The vulnerability stems from the isloWorkspacePath function returning a path derived from configuration without validating containment under the intended /workspace root. The Islo provider reads workspace location from configuration sourced from .crabbox.yaml or crabbox.yaml. An attacker who controls these files can supply traversal sequences such as ../../etc or absolute paths like /etc. The unsanitized path is then passed to prepareWorkspace, which performs destructive filesystem operations.

The destructive impact is amplified when sync.delete is enabled in the provider configuration. The workspace preparation routine invokes rm -rf against the resolved path before recreating it with mkdir -p. Because the path escapes the workspace sandbox, attackers can delete arbitrary directories and files accessible to the Crabbox process. See the VulnCheck Advisory: CrabBox Path Traversal for the upstream analysis.

Root Cause

The root cause is missing path containment validation in isloWorkspacePath. The original implementation returned a path string directly without verifying that the resolved absolute path remained a child of the intended /workspace root. No canonicalization or prefix check rejected traversal sequences or absolute path overrides supplied through YAML configuration.

Attack Vector

Exploitation requires local access and user interaction, since the attacker must place a malicious .crabbox.yaml or crabbox.yaml in a project directory that a victim later processes with Crabbox. When the victim runs the Islo provider against the attacker-supplied configuration with sync.delete enabled, the malicious workspace path triggers arbitrary deletion.

// Security patch in internal/providers/islo/backend.go
// [security] fix(islo): contain workdir paths under workspace (#65)
 	if err := rejectIsloSyncOptions(req); err != nil {
 		return RunResult{}, err
 	}
+	workspace, err := isloWorkspacePath(b.cfg)
+	if err != nil {
+		return RunResult{}, err
+	}
 	started := b.now()
 	client, err := newIsloClient(b.cfg, b.rt)
 	if err != nil {

Source: GitHub Commit 6b07193

// Security patch in internal/providers/islo/sync.go
// isloWorkspacePath now returns an error when containment fails
 		return nil, 0, err
 	}
 	preflightDuration := b.now().Sub(preflightStarted)
-	workspace := isloWorkspacePath(b.cfg)
+	workspace, err := isloWorkspacePath(b.cfg)
+	if err != nil {
+		return nil, 0, err
+	}
 	prepareStarted := b.now()
 	if err := b.prepareWorkspace(ctx, client, name, workspace); err != nil {
 		return nil, 0, err

Source: GitHub Commit 6b07193. The patch changes isloWorkspacePath to return an error when the resolved path fails containment validation, propagating the error rather than executing destructive operations.

Detection Methods for CVE-2026-45224

Indicators of Compromise

Presence of .crabbox.yaml or crabbox.yaml files containing workspace path values with .. sequences or absolute paths outside /workspace.
Unexpected execution of rm -rf followed by mkdir -p against system directories by the Crabbox process.
Missing directories or files in locations accessible to the user running Crabbox after invoking the Islo provider.

Detection Strategies

Scan repositories and project directories for Crabbox YAML configuration files containing path traversal patterns prior to execution.
Audit process telemetry for rm -rf and mkdir -p invocations whose target paths are not children of the configured workspace root.
Monitor Crabbox provider logs for workspace resolution events targeting paths outside /workspace.

Monitoring Recommendations

Enable filesystem auditing on hosts running Crabbox to capture deletion events on sensitive directories such as /etc, /var, and user home directories.
Alert on Crabbox process activity outside its expected working directory tree.
Track installed Crabbox versions across CI/CD runners and developer workstations to identify hosts running vulnerable releases below 0.9.0.

How to Mitigate CVE-2026-45224

Immediate Actions Required

Upgrade Crabbox to version 0.9.0 or later, which adds path containment validation in isloWorkspacePath.
Inventory all hosts and pipelines running Crabbox and prioritize upgrades on systems that process untrusted repositories.
Review existing .crabbox.yaml and crabbox.yaml files in shared repositories for malicious workspace path entries.

Patch Information

The fix is included in the Crabbox v0.9.0 release. The patch is tracked in Pull Request #65 and applied in commit 6b07193fb5670aac315ea47215651c67b8127868. The updated isloWorkspacePath function now returns an error when the resolved workspace path is not contained within the expected root, and callers propagate the error to abort destructive operations.

Workarounds

Disable the sync.delete option in Islo provider configurations until upgrading, removing the rm -rf execution path.
Run Crabbox under a low-privilege user account with no write access to sensitive directories outside the intended workspace.
Avoid executing Crabbox against untrusted repositories or YAML configuration files from external sources.

bash

# Verify installed Crabbox version and upgrade if below 0.9.0
crabbox --version

# Audit repositories for suspicious workspace path declarations
grep -rEn 'workspace:.*(\.\./|^/)' --include='*.crabbox.yaml' --include='crabbox.yaml' .