CVE-2026-55092
NoneCVSS
—
EPSS
0.4%
Published
Jun 25, 2026
CISA due date
—
The record
Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a path outside the intended destination, causing Trivy to write the layer content to an arbitrary location on the host filesystem. This vulnerability is fixed in 0.71.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | trivy | 0 | 0.71.2-2.1 |
Related vulnerabilities
- CVE-2026-53492 containerd is an open-source container runtime. Also affects trivy
- CVE-2026-53489 containerd is an open-source container runtime. Also affects trivy
- CVE-2026-50195 containerd is an open-source container runtime. Also affects trivy
- CVE-2026-47262 containerd is an open-source container runtime. Also affects trivy
- CVE-2026-53488 containerd is an open-source container runtime. Also affects trivy
- CVE-2026-54448 Trivy is a security scanner. Also affects trivy
- CVE-2026-44740 Billy is an interface filesystem abstraction for Go. Also affects trivy
- CVE-2026-27136 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects trivy