HIGH8.7
GO-2026-6591
ZITADEL: Actions V1 sandbox escape: host file read via require() in github.com/zitadel/zitadel
Quick fix
GO-2026-6591 — github.com/zitadel/zitadel: upgrade to the fixed version with the command below.
go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260717062331-baf6ed501b68Details
ZITADEL: Actions V1 sandbox escape: host file read via require() in github.com/zitadel/zitadel
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/zitadel/zitadel
Introduced in:
0Fixed in: 1.80.0-v2.20.0.20260717062331-baf6ed501b68Fix
go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260717062331-baf6ed501b68References
- https://github.com/zitadel/zitadel/security/advisories/GHSA-fgmf-7rf8-m6vf[ADVISORY]
- https://github.com/zitadel/zitadel/commit/afe108640cf57a17e8b743fbcdad9ae636eb3eb7[FIX]
- https://github.com/zitadel/zitadel/commit/baf6ed501b684f47048553d9034e8d3aa824950e[FIX]
- https://github.com/zitadel/zitadel/commit/e28d6bcc033368c3e9683ee15c195b8460b9305d[FIX]
- https://github.com/zitadel/zitadel/releases/tag/v3.4.13[WEB]
- https://github.com/zitadel/zitadel/releases/tag/v4.16.1[WEB]