# Path traversal to tokens and metadata

User-controlled paths joined and read without dot-dot checks, reaching tokens, process memory or instance metadata

_Area: Cloud and container security. Seen in 2 disclosed reports; latest 2026-10-29. Updated 2026-11-02._

## How it works
A component takes a user-supplied path, joins it to a trusted base directory, and reads the result. The assumption is that the join keeps the read inside the base. It does not: `..` segments (or an absolute path that replaces the base entirely) escape it. What sits outside the base is the prize — a ServiceAccount token, a process memory file, or a metadata endpoint. The same class appears when a sandboxed or in-memory filesystem is swapped for real OS file APIs: the containment guarantee that made the old code safe silently disappears [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-j5q5-j9gm-2w5c.md).

## Where it shows up
- `filepath.Join`/`os.ReadFile` (or equivalent) on a request parameter with no `..` or absolute-path rejection [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-j5q5-j9gm-2w5c.md).
- Download/file endpoints that accept absolute paths outside their documented root [E1](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-journey-into-claudes-sandbox.md).
- Refactors replacing an in-memory or virtual FS with shelling out to real tools and OS reads [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-j5q5-j9gm-2w5c.md).
- Resolver/controller pods whose ServiceAccount token is readable from the process filesystem [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-j5q5-j9gm-2w5c.md).
- Sandboxed runtimes where the model or workload can read infrastructure process memory holding live JWTs [E1](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-journey-into-claudes-sandbox.md).
- Local-connection blocks that only check loopback source addresses rather than network capability [E1](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-journey-into-claudes-sandbox.md).

## How to review
Find every user-controlled path that reaches a file read. The invariant: after resolution, the canonical path must still be inside the intended base directory, and absolute inputs must be rejected, not joined. Check the code path actually in use, not the one the docs describe — trace the refactor that changed the filesystem. For each such read, ask what credential or secret is reachable from that process (SA token, env, memory) and whether the pod's role is broader than the read needs [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-j5q5-j9gm-2w5c.md). For sandboxes, verify the download API enforces its root and that the control service authenticates on more than source address [E1](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-journey-into-claudes-sandbox.md).

## How finders spotted it
- Asked the agent to describe its own sandbox; consistent answers across sessions revealed the control service, mounts, IPs and WebSocket channel, guiding targeted download and memory requests [E1](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-journey-into-claudes-sandbox.md).
- Traced the refactor commit that replaced go-git's in-memory FS with real filesystem reads, then noted the user path was unvalidated [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-j5q5-j9gm-2w5c.md).
- Fingerprinted the login page to pin the exact product version, matched it to a known CVE, then pivoted through build parameters and IMDS [E3](https://bugbountylibrary.com/r/blog%3Aprojectdiscovery-io-blog-red-teaming-cloud-infrastructure-with-neo.md).

## Variants seen
- Absolute-path download escaping a sandbox root, plus process-memory read yielding a live GCP token [E1](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-journey-into-claudes-sandbox.md).
- `pathInRepo` traversal in a CI resolver pod reading its own SA token [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-j5q5-j9gm-2w5c.md).
- Path-traversal auth bypass in a CI server leading to IMDSv1 credential theft [E3](https://bugbountylibrary.com/r/blog%3Aprojectdiscovery-io-blog-red-teaming-cloud-infrastructure-with-neo.md).

## Impact and severity
High to critical. Traversal reached cluster-wide secrets via the resolver SA token [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-j5q5-j9gm-2w5c.md), internal control-plane access via a reconstructed JWT [E1](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-journey-into-claudes-sandbox.md), and, chained with IMDSv1 and duplicated secrets, 847K customer records [E3](https://bugbountylibrary.com/r/blog%3Aprojectdiscovery-io-blog-red-teaming-cloud-infrastructure-with-neo.md). Impact rose with the privileges of the traversed process and secret duplication across stores [E3](https://bugbountylibrary.com/r/blog%3Aprojectdiscovery-io-blog-red-teaming-cloud-infrastructure-with-neo.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **github.com/tektoncd/pipeline (go)** >= 1.0.0, < 1.0.1, fixed in 1.0.1: Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod (CVE-2026-33211). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-j5q5-j9gm-2w5c.md. Fix: https://github.com/tektoncd/pipeline/commit/10fa538f9a2b6d01c75138f1ed7ba3da0e34687c

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-journey-into-claudes-sandbox.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-j5q5-j9gm-2w5c.md
- E3: https://bugbountylibrary.com/r/blog%3Aprojectdiscovery-io-blog-red-teaming-cloud-infrastructure-with-neo.md