{"answers":{"affected":"3 open source packages ship an affected version, including github.com/zitadel/zitadel.","exploited":"There is no known exploitation of CVE-2026-85057 in the wild and no public exploit code.","fix":"Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260717062331-baf6ed501b68 or later.","what":"CVE-2026-85057 is a high-severity path traversal vulnerability in zitadel, published on 24 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-85057 and fix it if it is affected.\n\nWhat it is: CVE-2026-85057 is a high-severity path traversal vulnerability in zitadel, published on 24 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-85057 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/zitadel/zitadel (Go): affected all versions; fixed in 1.80.0-v2.20.0.20260717062331-baf6ed501b68\n- github.com/zitadel/zitadel (Go): affected all versions; fixed in 1.80.0-v2.20.0.20260717062331-baf6ed501b68\n- github.com/zitadel/zitadel (Go): affected all versions; fixed in 1.80.0-v2.20.0.20260717062331-baf6ed501b68\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-85057/ (Markdown: https://insights.sbomify.com/CVE-2026-85057/index.md)","id":"CVE-2026-85057","markdown":"https://insights.sbomify.com/CVE-2026-85057/index.md","name":"CVE-2026-85057","record":{"aliases":["GHSA-fgmf-7rf8-m6vf","GO-2026-6591"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_read","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"Identity management platform","requires_auth":"high_privilege","summary":"An organization admin can read server files via unrestricted require() in Actions V1, disclosing secrets and enabling privilege escalation to instance admin.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":8.7,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"description":"ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action author with ORG_OWNER, org.action.write, and org.flow.write permissions can run JavaScript at OIDC, SAML, and login-flow trigger points and load files readable by the ZITADEL server process. This can disclose mounted configuration and secrets, including credentials stored through ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and recovered bootstrap credentials can enable escalation from an organization administrator to an instance administrator. The issue affects Actions V1, and host command execution is not established. This issue is fixed in versions 3.4.13 and 4.16.1.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ZITADEL: Actions V1 sandbox escape: host file read via require()","id":"CVE-2026-85057","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":3,"n_references":6,"next":{"headline":"Moquette: Missing Authorization in io.moquette:moquette-broker","id":"CVE-2026-85058"},"packages":[{"ecosystem":"Go","fixed":["1.80.0-v2.20.0.20260717062331-baf6ed501b68"],"introduced":["0"],"last_affected":[],"package":"github.com/zitadel/zitadel","purl":null,"source":"GHSA-fgmf-7rf8-m6vf"},{"ecosystem":"Go","fixed":["1.80.0-v2.20.0.20260717062331-baf6ed501b68"],"introduced":["0"],"last_affected":[],"package":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","source":"GHSA-fgmf-7rf8-m6vf"},{"ecosystem":"Go","fixed":["1.80.0-v2.20.0.20260717062331-baf6ed501b68"],"introduced":["0"],"last_affected":[],"package":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","source":"GO-2026-6591"}],"prev":{"headline":"ZITADEL: MFA bypass via session reuse in Login V2","id":"CVE-2026-85056"},"products":["zitadel"],"published":"2026-09-24","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-05","vendors":["zitadel"]},"summary":"An organization admin can read server files via unrestricted require() in Actions V1, disclosing secrets and enabling privilege escalation to instance admin.","url":"https://insights.sbomify.com/CVE-2026-85057/"}