Crabbox Path Traversal (CVE-2026-45224) Enables Arbitrary File Deletion

The National Vulnerability Database has disclosed CVE-2026-45224, a high-severity path traversal vulnerability in Crabbox before version 0.9.0. This flaw resides within the Islo provider’s workspace path resolution, allowing attackers to manipulate paths to resolve outside the intended /workspace directory.

Attackers can craft malicious .crabbox.yaml or crabbox.yaml files containing traversal sequences. If the sync.delete option is enabled, the workspace preparation logic — which executes rm -rf and mkdir -p operations without proper path validation — will cause arbitrary file deletion and overwriting. This isn’t just a theoretical bug; it’s a direct path to system compromise through data destruction or manipulation.

With a CVSS score of 7.1 (HIGH), this vulnerability poses a significant risk. The attacker’s calculus is straightforward: leverage a seemingly innocuous configuration file to achieve impactful filesystem operations. Defenders need to understand that this isn’t about code execution directly, but about achieving destructive impact via misconfigured or vulnerable file operations.