Path Traversal in Beta9 Worker Sandbox File API

The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount's source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker's own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod's

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This critical vulnerability (CVSS 9.9) affects Beta9's worker sandbox file API, which improperly validates container paths before resolving them to worker host paths. The flaw exploits how filepath.Join handles parent-directory traversal segments (../) after an initial prefix check, allowing attackers to escape intended mount boundaries and access arbitrary absolute paths on the worker system. Organizations running Beta9 infrastructure are directly affected, particularly those processing untrusted workloads or multi-tenant environments where path isolation is a security boundary. The vulnerability enables complete file system access on affected workers, potentially exposing sensitive data, configuration files, credentials, and system binaries.

Casky's 351 matching skills leverage Claude's extended reasoning to detect this attack pattern across two key MITRE ATT&CK techniques: TA0001 (Initial Access) and TA0007 (Discovery). Practitioners using Casky would identify anomalous path resolution behaviors—specifically requests containing excessive parent-directory traversal sequences targeting mount points like /tmp/.beta9, followed by absolute path access attempts. The platform's skills would flag suspicious filepath.Join operations that bypass validation through timing-based prefix checks, detect access patterns attempting to escape container boundaries, and correlate discovery activity (reconnaissance of /etc, /root, /proc) following successful path traversal. Security teams would receive findings showing the complete attack chain: malicious path construction → validation bypass → unauthorized host filesystem access, enabling rapid containment and investigation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-120307.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-120307

Casky has 351 skills that investigate the attack patterns behind CVE-2026-120307. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn