Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120307— Beta9 container escape via unvalidated sandbox file paths

Quick assessment

Affected
beam-cloud Beta9 worker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Beta9 工作节点（worker）在容器外部提供沙箱文件 API 服务。 函数将租户的容器路径转换为工作节点路径。如果未解析的路径以某个挂载目标开头（包括默认上传挂载点 ），则会将剩余部分通过 拼接到该挂载点的源路径上；而 会在前缀检查之后清理父目录层级段（即 ）。若连续出现足够多的此类段，即可构造出指向工作节点上任意绝对路径的路径。对于不匹配任何挂载点的路径，系统会将其拼接到容器根目录，并在工作节点自身的文件系统中打开，因此像 这样指向 的绝对符号链接会被解析到工作节点的根目录下。 上传、下载、获取文件状态、列

CVSS 9.9 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
beam-cloud Beta9 worker < 0.1.756 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120307

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Beta9 container escape via unvalidated sandbox file paths
Source: CVE Program / CVE List V5
Vulnerability Description
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount's source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker's own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod's Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin. Fixed in worker 0.1.756: sandbox file operations and workspace sync open paths with os.OpenRoot, so parent-directory and symlink lookups stay inside the container root or the mount source.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
beam-cloud Beta9 worker 0 ~ 0.1.756 -

II. Public POCs for CVE-2026-120307

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120307

请登录查看更多情报信息。

Other References for CVE-2026-120307 (4)

Same Patch Batch · beam-cloud · 2026-11-01 · 3 CVEs total

CVE-2026-120308 9.9 CRITICAL Beta9 host filesystem exposure via volume path traversal
CVE-2026-120306 9.9 CRITICAL Beta9 build sandbox escape via chroot-only isolation

IV. Related Vulnerabilities

Same product: Beta9 worker
Same vendor: beam-cloud
Same weakness: CWE-22