CVE-2026-24686
Description
go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a `repoName` containing traversal (e.g., `../escaped-repo`) and cause go-tuf to create directories and write the root metadata file outside the intended `LocalMetadataDir` cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.
How to fix
- theupdateframework go-tuf2.4.1 or later
- github.com/theupdateframework/go-tuf/v22.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| theupdateframework go-tuf | 2.0.0 ≤ v < 2.4.1 | 2.4.1 |
| github.com/theupdateframework/go-tuf/v2Go | v < 2.4.1 | 2.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.