CVE-2026-55092 Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts
An attacker can force Trivy to write files to arbitrary locations on the host filesystem by crafting a malicious OCI artifact annotation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-55092?
CVE-2026-55092 is a high-severity path traversal vulnerability in aquasecurity trivy, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a path outside the intended destination, causing Trivy to write the layer content to an arbitrary location on the host filesystem. This vulnerability is fixed in 0.71.1.
Weakness: CWE-22
Which versions are affected by CVE-2026-55092?
3 open source packages ship an affected version, including github.com/aquasecurity/trivy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/aquasecurity/trivy Go | All versions | 0.71.1 |
github.com/aquasecurity/trivy Go | All versions | 0.71.1 |
github.com/aquasecurity/trivy Go | All versions | 0.71.1 |
Products include Aquasec Trivy.
How do I fix CVE-2026-55092?
Upgrade github.com/aquasecurity/trivy to 0.71.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-55092 being exploited?
There is no known exploitation of CVE-2026-55092 in the wild and no public exploit code.
Other vulnerabilities in aquasecurity trivy
Sources
Also known as GHSA-mcj4-mphf-j9ff, GO-2026-6294, MINI-46gf-4h67-9q7v, MINI-48q6-3gv2-h459, MINI-52j7-25r3-v4m8, MINI-57mh-q5qm-5mvx and 23 more.