CVE-2026-45224 Details

A path traversal vulnerability has been identified in Crabbox versions prior to 0.9.0, specifically within the Islo provider's workspace path resolution. This vulnerability allows attackers to provide absolute or relative paths that escape the intended '/workspace' directory. By crafting a malicious '.crabbox.yaml' or 'crabbox.yaml' file with traversal sequences, attackers can manipulate the workspace preparation logic to execute arbitrary file deletions and overwrites, particularly when 'sync.delete' is enabled. The issue arises because the workspace preparation process performs 'rm -rf' and 'mkdir -p' operations on the resolved path without adequate validation.

Users can upgrade to Crabbox version 0.9.0 or later, where this vulnerability has been fixed.