CVE-2026-63328

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959
https://github.com/aquasecurity/trivy/releases/tag/v0.72.0
https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw

Configurations

No configuration.

History

22 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Trivy es un escáner de seguridad. Antes de la versión 0.72.0, los metadatos del manifiesto del plugin son utilizados por pkg/plugin/manager.go para construir rutas bajo ~/.trivy/plugins sin confinar los nombres de los plugins a esa raíz, permitiendo a un atacante que persuade a un usuario para instalar o ejecutar un plugin malicioso escribir el manifiesto y el binario del plugin en rutas arbitrarias donde el usuario tenga permisos de escritura, mientras que los plugins del índice oficial de plugins de Trivy no se ven afectados. Este problema está solucionado en la versión 0.72.0.

Information

Published : 2026-08-18 16:18

Updated : 2026-10-22 22:10

NVD link : CVE-2026-63328

Mitre link : CVE-2026-63328

CVE.ORG link : CVE-2026-63328

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-63328", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63328", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T15:48:35.086779Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "aquasecurity", "product": "trivy", "versions": [{"status": "affected", "version": "< 0.72.0"}]}]}], "published": "2026-08-18T16:18:12.387", "references": [{"url": "https://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959", "source": "security-advisories@github.com"}, {"url": "https://github.com/aquasecurity/trivy/releases/tag/v0.72.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0."}, {"lang": "es", "value": "Trivy es un esc\u00e1ner de seguridad. Antes de la versi\u00f3n 0.72.0, los metadatos del manifiesto del plugin son utilizados por pkg/plugin/manager.go para construir rutas bajo ~/.trivy/plugins sin confinar los nombres de los plugins a esa ra\u00edz, permitiendo a un atacante que persuade a un usuario para instalar o ejecutar un plugin malicioso escribir el manifiesto y el binario del plugin en rutas arbitrarias donde el usuario tenga permisos de escritura, mientras que los plugins del \u00edndice oficial de plugins de Trivy no se ven afectados. Este problema est\u00e1 solucionado en la versi\u00f3n 0.72.0."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "security-advisories@github.com"}