PT-2026-31461 · Unknown · The Sleuth Kit

Mobasi · Published 2026-04-08 · Updated 2026-04-17 · CVE-2026-40024

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions The Sleuth Kit versions through 4.14.0

Description The Sleuth Kit’s tsk recover component contains a path traversal flaw. An attacker can exploit this to write files to locations outside the intended recovery directory by using crafted filenames or directory paths within a filesystem image that include path traversal sequences. Specifically, crafting a malicious filesystem image with embedded '/../' sequences in filenames allows an attacker to write files outside the output directory when processed by tsk recover, potentially leading to code execution by overwriting system files like shell configurations or cron entries.

Recommendations Update versions of The Sleuth Kit to a version later than 4.14.0.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-40024

OESA-2026-1934

OESA-2026-1935

OESA-2026-1936

OESA-2026-1937

OESA-2026-1938

OESA-2026-1939

Affected Products

The Sleuth Kit

References · 24

• https://github.com/sleuthkit/sleuthkit/commit/a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b · Patch
• https://osv.dev/vulnerability/OESA-2026-1934 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1935 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40024 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1937 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40024 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40024 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1939 · Vendor Advisory
• https://mobasi.ai/sentinel · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40026 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40024 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-40024 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1938 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40025 · Security Note