Technical impact
The discover_pipeline_files() function in ciguard’s discovery module walks a directory tree, following symbolic links with only cycle protection based on visited resolved paths. This design flaw allows an attacker who can place a symlink inside a directory that a CI/CD scan processes to cause the discovery routine to traverse outside the intended scan root and reveal paths to pipeline‑styled files that are not part of the targeted repository. The vulnerability is a classic directory traversal issue identified as CWE‑59 and can result in unauthorized disclosure of internal pipeline artifacts or configuration files.
Affected Systems
Ciguard versions 0.8.0 through 0.8.1, inclusive, are affected. The issue has been patched in release 0.8.2, so any deployment using 0.8.0 or 0.8.1 requires an upgrade to avoid the exposed file paths.
Risk and Exploitability
The CVSS score of 3.2 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been actively exploited in the wild. Attackers would need local or elevated privileges to place a symlink within a scanned directory, making the threat scope limited to environments where build agents or CI runners run with write access to the repository’s working tree. Without such privileges, the risk remains low. Nevertheless, the potential for leaking sensitive pipeline configuration warrants prompt remediation.
Github GHSA