# CVE-2026-120307: Beta9 worker path traversal in sandbox file API

Source: https://junglewise.ai/threats/cve-2026-120307-the-beta9-worker-serves-the-sandbox-file-api-from-outside-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-120307 · Severity: critical · CVSS 9.9 · Published 2026-11-01

Beta9 is a serverless GPU inference platform that isolates tenant workloads in sandboxes. A vulnerability in how the worker handles file paths allows an authenticated tenant with a running sandbox to escape the container boundary and read, write, delete, or list files on the host worker as root, including files belonging to other tenants and sensitive system files like Kubernetes credentials.

Technologies: [Beam Cloud Beta9 Worker](https://junglewise.ai/threats/technologies/beta9-worker). Vendors: [Beam Cloud](https://junglewise.ai/threats/vendors/beam-cloud).

## Quick answers

**Is CVE-2026-120307 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120307 being exploited in the wild.

**How severe is CVE-2026-120307?** Critical severity, with a CVSS score of 9.9, published 1 November 2026.

**Which products and versions are affected?** Beam Cloud Beta9 Worker before 0.1.756.

**Is there a fix for CVE-2026-120307?** Yes: fixed in worker 0.1.756. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120307 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-120307?** Check whether you run Beam Cloud Beta9 Worker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in worker 0.1.756

## Technical details

The getHostPathFromContainerPath function fails to properly validate container paths before resolving them against the host filesystem. An attacker can use parent-directory traversal segments (cleaned after a prefix check) and absolute symbolic links to escape the container root or mount source boundaries. The vulnerability affects upload, download, stat, list, find-in-files, replace-in-files, and delete-file operations. A proof-of-concept successfully retrieved the worker pod's Kubernetes service account token (bound to cluster-admin) through a non-existent path.

## Affected products

- beam-cloud Beta9 worker before 0.1.756

## Timeline

- 2026-11-01: disclosed: CVE-2026-120307 published

## References

- [https://github.com/beam-cloud/beta9/releases](https://github.com/beam-cloud/beta9/releases)
- [https://github.com/beam-cloud/beta9](https://github.com/beam-cloud/beta9)

## Related threats

- [Beta9 path traversal in volume attachment](https://junglewise.ai/threats/cve-2026-120308-a-beta9-tenant-can-attach-a-volume-when-deploying-a-function)
- [Beta9 worker container escape via Buildah namespace isolation bypass](https://junglewise.ai/threats/cve-2026-120306-beta9-turns-each-shell-command-in-a-tenant-image-definition-into)