High severity7.5NVD Advisory· Published Jun 25, 2026· Updated Jun 27, 2026
CVE-2026-55092
CVE-2026-55092
Description
Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a path outside the intended destination, causing Trivy to write the layer content to an arbitrary location on the host filesystem. This vulnerability is fixed in 0.71.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/aquasecurity/trivyGo | < 0.71.1 | 0.71.1 |
Affected products
6- osv-coords4 versionspkg:rpm/opensuse/trivy&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0pkg:apk/chainguard/cloudbeat-9.2pkg:rpm/opensuse/trivy&distro=openSUSE%20Tumbleweed
< 0.72.0-160000.1.1+ 3 more
- (no CPE)range: < 0.72.0-160000.1.1
- (no CPE)range: < 0.0.20260827T195228-160000.1.1
- (no CPE)range: < 9.2.8-r20
- (no CPE)range: < 0.71.2-2.1
- Range: <0.71.1
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-mcj4-mphf-j9ffghsaADVISORY
- github.com/aquasecurity/trivy/security/advisories/GHSA-mcj4-mphf-j9ffnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-55092ghsaADVISORY
- github.com/aquasecurity/trivy/commit/39e0b132260c60d59fa746c3f6dd10374b0ff6e4ghsaWEB
- github.com/aquasecurity/trivy/commit/a72d9a4d997c25fbb6534e231b4e206c9b202b31ghsaWEB
- github.com/aquasecurity/trivy/releases/tag/v0.71.1ghsaWEB
News mentions
0No linked articles in our index yet.