Is CVE-2026-40024 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40024 being exploited in the wild.

How severe is CVE-2026-40024?

High severity, with a CVSS score of 7.1, published 8 April 2026.

Which products and versions are affected?

Sleuth Kit The Sleuth Kit through 4.14.0.

Is there a fix for CVE-2026-40024?

A patch was published on 2026-04-08: Fix identified in GitHub commit a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40024 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-40024?

Check whether you run Sleuthkit The Sleuth Kit. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40024: The Sleuth Kit path traversal in tsk_recover

CVE-2026-40024 · Severity: high · CVSS 7.1 · Published 2026-04-08

The Sleuth Kit is a collection of command-line tools used by digital forensics investigators to analyze disk images and recover files. A vulnerability in the 'tsk_recover' tool allows a malicious disk image to write files to unintended locations on the investigator's computer. This could allow an attacker to gain control of the system by overwriting critical startup files or configuration settings when the investigator attempts to process the evidence.

Technologies: Sleuthkit The Sleuth Kit. Vendors: Sleuthkit.

Quick answers

Is CVE-2026-40024 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40024 being exploited in the wild.
How severe is CVE-2026-40024?: High severity, with a CVSS score of 7.1, published 8 April 2026.
Which products and versions are affected?: Sleuth Kit The Sleuth Kit through 4.14.0.
Is there a fix for CVE-2026-40024?: A patch was published on 2026-04-08: Fix identified in GitHub commit a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40024 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-40024?: Check whether you run Sleuthkit The Sleuth Kit. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the tsk_recover utility of The Sleuth Kit through version 4.14.0. The root cause is insufficient sanitization of filenames and directory paths within a processed filesystem image. An attacker can craft a malicious image containing filenames with '../' sequences; when tsk_recover processes this image, it may write files to arbitrary locations on the host filesystem. This can lead to local code execution if the attacker overwrites sensitive files such as .bashrc or cron entries. Exploitation requires the victim to run tsk_recover on a malicious image. A fix is available in the project's source repository (commit a3f96b3).

Affected products

Sleuth Kit The Sleuth Kit through 4.14.0

Timeline

2026-03-05: disclosed: Initial discovery by Mobasi Sentinel program
2026-04-08: advisory: NVD and VulnCheck publication
2026-04-08: patched: Fix identified in GitHub commit a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.