Directory Traversal Vulnerability in go-tuf by The Update Framework
CVE-2026-24686

4.7MEDIUM

Key Information:

Vendor

Theupdateframework

Status
Go-tuf
Vendor
CVE Published:
27 January 2026

What is CVE-2026-24686?

The go-tuf library, a Go implementation of The Update Framework, has a directory traversal vulnerability in its TAP 4 Multirepo Client. This issue arises when the application accepts a map file from an untrusted source, allowing an attacker to manipulate the 'repoName' parameter. By using traversal sequences like '../escaped-repo', an attacker can redirect write operations to unintended locations outside the designated LocalMetadataDir, potentially compromising the filesystem integrity. Fortunately, this vulnerability has been addressed in version 2.4.1.

Affected Version(s)

go-tuf >= 2.0.0, < 2.4.1

References

https://github.com/theupdateframework/go-tuf/security/adv...
x_refsource_CONFIRM
https://github.com/theupdateframework/go-tuf/commit/d361e...
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.