Executive brief
Path traversal in TAP 4 multirepo client allows arbitrary file write via repo names in github.com/theupdateframework/go-tuf
Affected products
- Go github.com/theupdateframework/go-tuf/v2
Junglewise Threat Intelligence
CVE-2026-24686: GO-2026-4377 - Path traversal in TAP 4 multirepo client allows arbitrary file write via repo names in github.com/theupdateframework/go-tuf
CVE-2026-24686 · Severity: low · CVSS 3.1 · Published 2026-02-02
Technologies: github.com/theupdateframework/go-tuf/v2 (Go). Vendors: Go.
Related threats
- GO-2026-4349 - Improper validattion of configured threshold for delegations in github.com/theupdateframework/go-tuf
- GO-2026-4348 - Client DoS via malformed server response in github.com/theupdateframework/go-tuf
- GO-2024-3166 - Incorrect delegation lookups can make go-tuf download the wrong artifact in github.com/theupdateframework/go-tuf