CVE-2026-24686
Published: July 22, 2026Last modified: July 31, 2026
Description
go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a `repoName` containing traversal (e.g., `../escaped-repo`) and cause go-tuf to create directories and write the root metadata file outside the intended `LocalMetadataDir` cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 4.7 |
| Attack Vector | LOCAL |
| Attack complexity | HIGH |
| Privileges required | LOW |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | NONE |
| Integrity impact | HIGH |
| Availability impact | NONE |
| Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N |
Notes
skopeo is not affected because it used go-tuf version < 2.0.0 docker-cli-buildx in 25 LTS is not affected because it doesn't use go-tuf dependency
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | skopeo | Not affected (1.10.0-r2) |
| 25 LTS | docker-cli-buildx | Not affected (0.24.0-r0) | |
| skopeo | Not affected (1.18.0-r2) | ||
| Stream | docker-cli-buildx | Fixed (0.32.0-r0) | |
| skopeo | Not affected (1.13.0-r1) |