Bug 2433138 (CVE-2026-24686) - CVE-2026-24686 github.com/theupdateframework/go-tuf/v2: go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names
Summary: CVE-2026-24686 github.com/theupdateframework/go-tuf/v2: go-tuf Path Traversal...
Keywords:
Status: NEW
Alias: CVE-2026-24686
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2434243 2434245 2434246 2434247 2434249
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-01-27 01:01 UTC by OSIDB Bzimport
Modified: 2026-01-28 19:14 UTC (History)
16 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-01-27 01:01:56 UTC 
go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a `repoName` containing traversal (e.g., `../escaped-repo`) and cause go-tuf to create directories and write the root metadata file outside the intended `LocalMetadataDir` cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.
Note You need to log in before you can comment on or make changes to this bug.