GO-2026-6294
Path traversal via crafted vulnerability database or other downloaded artifacts in github.com/aquasecurity/trivy
At a glance
- Published
- Updated
- CVE
- CVE-2026-55092
- Aliases
- GHSA-mcj4-mphf-j9ff
Description
Path traversal via crafted vulnerability database or other downloaded artifacts in github.com/aquasecurity/trivy
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/aquasecurity/trivy | introduced 0, fixed 0.71.1 |
References
- https://github.com/aquasecurity/trivy/security/advisories/GHSA-mcj4-mphf-j9ff ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-55092 ADVISORY
- https://github.com/aquasecurity/trivy/commit/39e0b132260c60d59fa746c3f6dd10374b0ff6e4 FIX
- https://github.com/aquasecurity/trivy/commit/a72d9a4d997c25fbb6534e231b4e206c9b202b31 FIX
- https://github.com/aquasecurity/trivy/releases/tag/v0.71.1 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |