Unrestricted file upload leading to privilege escalation in act
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-434.
Summary
act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege escalation. The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open. The /artifact endpoint is vulnerable to path traversal as the path is variable is user controlled, and the specified file is ultimately returned by the server. This has been addressed in version 0.2.40. Users are advised to upgrade. Users unable to upgrade may, during implementation of Open and OpenAtEnd for FS, ensure to use ValidPath() to check against path traversal or clean the user-provided paths manually.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nektos | act | before 0.2.40 | 0.2.40 | Patch available | CNA |
| — | github.com/nektos/act (Go) | before 0.2.40 | 0.2.40 | Patch available | GHSA-pc99-qmg4-rcff |
- act Vendornektos Affected before 0.2.40 Fixed in 0.2.40 Patch available CNA
- github.com/nektos/act (Go) Vendor— Affected before 0.2.40 Fixed in 0.2.40 Patch available GHSA-pc99-qmg4-rcff
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:act_project:act:*:*:*:*:*:go:*:* | before 0.2.40 | Vulnerable | Act Project |
- cpe:2.3:a:act_project:act:*:*:*:*:*:go:*:* Versions before 0.2.40 Vulnerable ·Act Project
Remediation
- Fix · CNA act (nektos) Fixed in 0.2.40
- Fix · GHSA-pc99-qmg4-rcff github.com/nektos/act (Go) Fixed in 0.2.40 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-22726
- 2026-10-03 Alias added: GHSA-pc99-qmg4-rcff
References
Exploit 2
Advisory 6
- https://github.com/nektos/act/issues/1553
- https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65
- https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245
- https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2
- https://nvd.nist.gov/vuln/detail/CVE-2023-22726
- https://securitylab.github.com/advisories/GHSL-2023-004_act
More nektos vulnerabilities
- TI-2026-26366 act: Unrestricted set-env and add-path command processing enables environment injection CVSS 4.0HIGH 7.7
- TI-2026-53683 act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend CVSS 4.0HIGH 8.7
- TI-2026-26367 act: actions/cache server allows malicious cache injection CVSS 3.1HIGH 8.2
Sources
- CVE-2023-22726 · CVE Program
- CVE-2023-22726 · NVD
- FIRST EPSS
- GHSA-pc99-qmg4-rcff · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences