Path Traversal Vulnerability in Tough by AWS Labs

CVE-2026-6968

What is CVE-2026-6968?

In a recent assessment of the Tough library by AWS Labs, a vulnerability has been identified that allows remote authenticated users with delegated signing authority to exploit incomplete path traversal protections. This weakness enables the manipulation of file paths, which can lead to unauthorized file writing outside designated output directories. The issue primarily resides in the reliance on destination path concatenation for validation, lacking a robust containment verification post-resolution. As a result, absolute target names, symlinked parent directories, and specially crafted metadata filenames can facilitate this exploitation. Users are strongly advised to upgrade to Tough v0.22.0 and Tuftool v0.15.0 to mitigate risks associated with this vulnerability.

References