CVE-2026-63328CWE-22path-traversal

CVE-2026-63328

published August 18, 2026

CVSS
6.8
EPSS
0%
Percentile
8.2
In the wild
Unconfirmed
What it is

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.

The record
Technical detail
CVSS
6.8 · NONE
CVSS v4.0
6.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00190 · 8.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-18T20:18Z
References (3)
https://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959 · [email protected]https://github.com/aquasecurity/trivy/releases/tag/v0.72.0 · [email protected]https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw · [email protected]
EPSS history
Timeline
  • 18 AUG 15:14Z
    Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write
    cvelistv5