Is CVE-2026-55092 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55092 being exploited in the wild.

How severe is CVE-2026-55092?

High severity, with a CVSS score of 7.5, published 25 June 2026.

Which products and versions are affected?

Aqua Security Trivy < 0.71.1; github.com/aquasecurity/trivy (Go) < 0.71.1, SEMVER:introduced=0,fixed=0.71.1.

Is there a fix for CVE-2026-55092?

Yes. github.com/aquasecurity/trivy (Go): upgrade to 0.71.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55092 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-55092?

Check whether you run Aqua Security Trivy or github.com/aquasecurity/trivy (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55092: Aqua Security Trivy path traversal in OCI artifact downloading

Q: Which products and versions are affected?

Aqua Security Trivy < 0.71.1; github.com/aquasecurity/trivy (Go) < 0.71.1, SEMVER:introduced=0,fixed=0.71.1.

Q: Is there a fix for CVE-2026-55092?

Yes. github.com/aquasecurity/trivy (Go): upgrade to 0.71.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55092 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-55092?

Check whether you run Aqua Security Trivy or github.com/aquasecurity/trivy (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55092 · Severity: high · CVSS 7.5 · Published 2026-06-25

Trivy is a vulnerability scanner that downloads security databases and configuration bundles from container registries. When an attacker controls the source repository, they can craft a malicious annotation in the container manifest to write files to arbitrary locations on the scanning system. This could allow an attacker to modify SSH keys, shell configurations, or other files to achieve code execution with the privileges of the user running Trivy.

Technologies: Aqua Security Trivy, github.com/aquasecurity/trivy (Go). Vendors: Aqua Security, Go.

Quick answers

Is CVE-2026-55092 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55092 being exploited in the wild.
How severe is CVE-2026-55092?: High severity, with a CVSS score of 7.5, published 25 June 2026.
Which products and versions are affected?: Aqua Security Trivy < 0.71.1; github.com/aquasecurity/trivy (Go) < 0.71.1, SEMVER:introduced=0,fixed=0.71.1.
Is there a fix for CVE-2026-55092?: Yes. github.com/aquasecurity/trivy (Go): upgrade to 0.71.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55092 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-55092?: Check whether you run Aqua Security Trivy or github.com/aquasecurity/trivy (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/aquasecurity/trivy (Go): upgrade to 0.71.1 or later
```
go get github.com/aquasecurity/trivy@v0.71.1
```

Technical details

This is a path traversal vulnerability (CWE-22) in Trivy's OCI artifact handling. When Trivy downloads vulnerability databases, Java vulnerability databases, misconfiguration checks bundles, or WASM modules, it extracts the destination filename from the org.opencontainers.image.title annotation in the artifact manifest without validating or sanitizing the path. An attacker can supply a value like "../../../../tmp/malicious.sh" to place files outside the intended destination directory. Exploitation requires the attacker to control the OCI repository URL, which can be specified via --db-repository, --java-db-repository, --checks-bundle-repository flags or corresponding environment variables/config file settings. The attack is practical in scenarios where users copy commands from untrusted sources or use compromised mirrors. Default Trivy configuration (using Aqua-operated repositories) is unaffected. The vulnerability was patched in Trivy 0.71.1.

Affected products

Aqua Security Trivy < 0.71.1

Identifiers

CVE-2026-55092
GHSA-mcj4-mphf-j9ff
GO-2026-6294

Timeline

2026-06-15: disclosed
2026-06-15: patched: Patch released as Trivy 0.71.1
2026-08-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.