PT-2026-4844 · Go-Tuf · Go-Tuf

1Seal · Published 2026-01-26 · Updated 2026-05-18 · CVE-2026-24686

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions go-tuf versions prior to 2.4.1

Description go-tuf is a Go implementation of The Update Framework (TUF). The TAP 4 Multirepo Client uses the map file repository name string (repoName) as a filesystem path component when selecting the local metadata cache directory. If an application accepts a map file from an untrusted source, an attacker can supply a repoName containing traversal sequences (e.g., ../escaped-repo) and cause go-tuf to create directories and write the root metadata file outside the intended cache base, within the running process's filesystem permissions. This allows overwriting arbitrary files.

Recommendations Update to version 2.4.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CLEANSTART-2026-HF07497

CLEANSTART-2026-NV36169

CLEANSTART-2026-WN01990

CVE-2026-24686

GHSA-JQC5-W2XX-5VQ4

GO-2026-4377

OPENSUSE-SU-2026:10664-1

SUSE-SU-2026:0403-1

SUSE-SU-2026:0757-1

Affected Products

Go-Tuf

References · 301

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24686.json · Exploit
• https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-jqc5-w2xx-5vq4 · Vendor Advisory
• https://github.com/theupdateframework/go-tuf/commit/d361e2ea24e427581343dee5c7a32b485d79fcc0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27139 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22703 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33810 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61728 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-24686 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24686 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-NV36169 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68119 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61726 · Security Note
• https://osv.dev/vulnerability/GHSA-jqc5-w2xx-5vq4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34986 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-24686 · Vendor Advisory