CVE-2026-24686 go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names
An attacker can write arbitrary files outside the intended cache directory by supplying malicious repository names in the go-tuf TAP 4 Multirepo Client.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-24686?
CVE-2026-24686 is a medium-severity path traversal vulnerability in theupdateframework go-tuf, published on 27 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a `repoName` containing traversal (e.g., `../escaped-repo`) and cause go-tuf to create directories and write the root metadata file outside the intended `LocalMetadataDir` cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.
Weakness: CWE-22
Which versions are affected by CVE-2026-24686?
3 open source packages ship an affected version, including github.com/theupdateframework/go-tuf/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/theupdateframework/go-tuf/v2 Go | All versions | 2.4.1 |
github.com/theupdateframework/go-tuf/v2 Go | All versions | 2.4.1 |
github.com/theupdateframework/go-tuf/v2 Go | All versions | 2.4.1 |
Products include Theupdateframework Go-Tuf.
How do I fix CVE-2026-24686?
Upgrade github.com/theupdateframework/go-tuf/v2 to 2.4.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-24686 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24686 exists.
Other vulnerabilities in theupdateframework go-tuf
Sources
Also known as BELL-CVE-2026-24686, CLEANSTART-2026-AP98474, CLEANSTART-2026-BV58345, DEBIAN-CVE-2026-24686, GHSA-jqc5-w2xx-5vq4, GO-2026-4377 and 34 more.