SB2026081976 - Path traversal in Pivotal Concourse

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081976

SB2026081976 - Path traversal in Pivotal Concourse

Published: August 19, 2026

Security Bulletin ID SB2026081976
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to path traversal in secrets lookup when processing secret references in pipeline configurations. A local privileged user can write a crafted secret reference to disclose sensitive information.

User interaction is required, and exploitation requires permission to edit pipeline configurations and knowledge of the exact path of the target secret. Only secret managers that use path-style look-ups are affected.


Remediation

Install update from vendor's website.

References