# CVE-2026-47680: Flux source-controller path traversal in Bucket and GitRepository reconcilers

Source: https://junglewise.ai/threats/cve-2026-47680-flux-source-controller-path-traversal-in-bucket-and-gitrepository  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-47680 · Severity: medium · CVSS 4 · Published 2026-09-08

Flux source-controller, a component used to manage software deployments in Kubernetes, contains a vulnerability in how it handles file paths. An attacker with control over a storage bucket or specific repository settings could write files to unauthorized locations on the controller's system or discover the existence of sensitive files. While built-in security checks prevent these malicious files from being deployed to the wider cluster, the flaw could still be used to disrupt operations or gather information about the internal system environment.

Technologies: [github.com/fluxcd/source-controller (Go)](https://junglewise.ai/threats/technologies/github-com-fluxcd-source-controller). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-47680 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47680 being exploited in the wild.

**How severe is CVE-2026-47680?** Medium severity, with a CVSS score of 4, published 8 September 2026.

**Which products and versions are affected?** Flux CD Source-Controller >= 0.0.17, <= 1.8.4; github.com/fluxcd/source-controller (Go) >= 0.0.17, <= 1.8.4, SEMVER:introduced=0.0.17,fixed=1.8.5.

**Is there a fix for CVE-2026-47680?** Yes. github.com/fluxcd/source-controller (Go): upgrade to 1.8.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47680 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47680?** Check whether you run Flux CD Source-Controller or github.com/fluxcd/source-controller (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/fluxcd/source-controller (Go): upgrade to 1.8.5 or later

  ```sh
  go get github.com/fluxcd/source-controller@v1.8.5
  ```


## Technical details

The vulnerability consists of two path traversal issues within the Flux source-controller. First, the Bucket reconciler fails to properly validate object paths, allowing an attacker who can influence bucket contents to write data outside the intended working directory. Second, the GitRepository reconciler's sparse-checkout feature (introduced in v1.6.0) allows users with repository update permissions to use '..' or absolute paths to test for the existence of files on the controller pod's local filesystem. While Flux's digest verification prevents manipulated artifacts from being applied to the cluster, an attacker can still achieve arbitrary file writes within the pod's permission scope or perform limited file enumeration. The issues are addressed in version 1.8.5.

## Affected products

- Flux CD source-controller >= 0.0.17, <= 1.8.4

## Identifiers

- CVE-2026-47680
- GHSA-jjrm-hr5f-673x
- GO-2026-5472

## Timeline

- 2026-06-02: disclosed
- 2026-06-05: advisory
- 2026-06-05: patched: Fixed in v1.8.5

## References

- [https://api.github.com/users/hiddeco](https://api.github.com/users/hiddeco)
- [https://github.com/hiddeco](https://github.com/hiddeco)
- [https://api.github.com/users/hiddeco/gists%7B/gist_id%7D](https://api.github.com/users/hiddeco/gists%7B/gist_id%7D)
- [https://api.github.com/users/hiddeco/repos](https://api.github.com/users/hiddeco/repos)
- [https://avatars.githubusercontent.com/u/10063039?v=4](https://avatars.githubusercontent.com/u/10063039?v=4)
- [https://api.github.com/users/hiddeco/events%7B/privacy%7D](https://api.github.com/users/hiddeco/events%7B/privacy%7D)

## Related threats

- [GO-2024-2859 - source-controller leaks Azure Storage SAS token into logs in github.com/fluxcd/source-controller](https://junglewise.ai/threats/cve-2024-31216-source-controller-leaks-azure-storage-sas-token-into-logs)
- [GO-2022-1071 - Denial of service in flux controllers in github.com/fluxcd modules](https://junglewise.ai/threats/cve-2022-39272-improper-use-of-metav1-duration-allows-for-denial-of-service)