VulnSocial

CVE-2026-55092General(aquasec / trivy)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch aquasec trivy systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a path outside the intended destination, causing Trivy to write the layer content to an arbitrary location on the host filesystem. This vulnerability is fixed in 0.71.1.

aquasec CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • trivy

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-06-17); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
aquasec
Products
trivy

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-17: 1Mentions · 2026-06-26: 1Patch / Workaround · 2026-06-26: 1Technical Details · 2026-06-26: 106-1706-26
Signal classification2 categories
General
150.0%
Patch
150.0%
Classification over time
DateTotalLabels
2026-06-171
General1
2026-06-261
Patch1
Full discourse2 posts
  • Henrique Pereira@ikkebr
    General

    Earlier this year I set a goal to end the year with a couple CVEs to my name. So far, the year is going great: - CVE-2026-48579 (9.1 on MS Exchange) - CVE-2026-33102 (9.3 on M365 Copilot) - CVE-2026-21532 (8.2 on Azure Functions) - CVE-2026-44848 (9.4 on Portainer) - CVE-2026-55092 (8.0 on Trivy) Plus a plethora of other vulns I reported and got fixed without CVEs…

    Post summary

    The author announces several high‑severity CVEs they claim to have discovered but offers no evidence of PoCs, exploits, active attacks, patches, or technical specifics.

    0202242.0K
    965 followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨 HIGH - Trivy OCI artifact filename path traversal (CVE-2026-55092) Trivy before 0.71.1 improperly trusts the org.opencontainers.image.title annotation in an OCI artifact manifest and uses it as the destination filename when writing fetched content. The root cause is a path traversal flaw due to missing filename/path validation and sanitization. An attacker can exploit this by tricking Trivy into fetching an attacker-controlled OCI artifact with a crafted annotation containing traversal sequences, requiring only that the target runs Trivy against that artifact source. Impact includes arbitrary file write on the host filesystem, which can enable local privilege escalation, persistence, or service disruption depending on what paths are overwritten. 👉 Affected: trivy < 0.71.1 | Upgrade to 0.71.1

    Post summary

    The post reports a high‑severity path traversal flaw in Trivy < 0.71.1 and recommends upgrading to version 0.71.1 to remediate the issue.

    0000086
    231 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appaquasectrivy-go-

Explore more

Back to dashboardaquasec CVEstrivy vulnerabilities