Abdullah Kareem@CyberKareem
Disclosure
New CVE-2026-71493, path traversal in Infracost. Commit a directory symlink evil -> / to a repo, then {{ readFile "evil/file" }} in a config template. The path check passes lexically, but ReadFile follows the symlink and reads any file on the CI runner, output lands in the PR. https://t.co/vi4NCZq6JE
Post summary
The text announces a new CVE-2026-71493 path‑traversal flaw in Infracost, providing a simple PoC that shows how attackers can read any file on the CI runner by creating a symlink and using a readFile template function.
0000063
243 followersView on X