Path traversal in tough - CVE-2026-6968
Published: April 25, 2026
Vulnerability identifier: #VU127899
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-6968
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to write files outside intended output directories.
The vulnerability exists due to path traversal in copy_target, link_target, save_target, and SignedRole::write when processing repository-controlled target names, parent directories, and metadata filenames. A remote user can supply crafted repository metadata and target paths to write files outside intended output directories.
Exploitation requires delegated signing authority in the remote repository.
Affected software
tough
How to mitigate CVE-2026-6968
Install security update from vendor's website.
tough - update to 0.22.0