| id: GO-2026-4494 |
| modules: |
| - module: github.com/treeverse/lakefs |
| versions: |
| - fixed: 1.77.0 |
| vulnerable_at: 1.76.0 |
| summary: |- |
| lakeFS vulnerable to path traversal in local block adapter allow cross-namespace |
| and sibling directory access in github.com/treeverse/lakefs |
| cves: |
| - CVE-2026-26187 |
| ghsas: |
| - GHSA-699m-4v95-rmpm |
| references: |
| - advisory: https://github.com/treeverse/lakeFS/security/advisories/GHSA-699m-4v95-rmpm |
| - web: https://github.com/treeverse/lakeFS/commit/cbc106275357302a834280f133265dc39f1384ce |
| - web: https://github.com/treeverse/lakeFS/releases/tag/v1.77.0 |
| source: |
| id: GHSA-699m-4v95-rmpm |
| created: 2026-02-13T20:19:03.000741092Z |
| review_status: UNREVIEWED |
