Medium severity5.9NVD Advisory· Published Apr 24, 2026· Updated May 6, 2026
CVE-2026-6968
CVE-2026-6968
Description
Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copy_target/link_target, symlinked parent directories in save_target, or symlinked metadata filenames in SignedRole::write, because write paths trust the joined destination path without post-resolution containment verification.
We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4Patches
Vulnerability mechanics
References
6- aws.amazon.com/security/security-bulletins/2026-019-aws/nvdVendor Advisory
- github.com/awslabs/tough/security/advisories/GHSA-v57p-gppj-p9vgnvdVendor Advisory
- crates.io/crates/tough/0.22.0nvdProduct
- crates.io/crates/tuftool/0.15.0nvdProduct
- github.com/awslabs/tough/releases/tag/tough-v0.22.0nvdRelease Notes
- github.com/awslabs/tough/releases/tag/tuftool-v0.15.0nvdRelease Notes
News mentions
0No linked articles in our index yet.