Fatih Çelik@fatihclk01
Disclosure
I recently discovered a Path Traversal vulnerability (CVE-2026-63328) in the plugin manager of Trivy, one of my favorite open-source security tools. The team has promptly addressed this in the v0.72.0 release. Through this flaw, a maliciously crafted plugin.yaml file could escape the designated plugin directory during installation, allowing an attacker to overwrite files on the system. Read the full technical write-up here: https://fatihhcelik.github.io/posts/trivy-path-traversal-plugin-manager/
Post summary
The post announces the discovery of a path traversal vulnerability in Trivy’s plugin manager (CVE‑2026‑63328), describes how a crafted plugin.yaml can overwrite system files, and notes that the issue is fixed in version 0.72.0.
020104871
477 followersView on X