Executive brief
The python-tuf library, which provides a framework for secure software updates, contains a vulnerability in how it validates file paths on Windows systems. Due to inconsistent handling of uppercase and lowercase letters, an attacker who controls a specific update role could potentially bypass security restrictions to provide unauthorized software updates. This could lead to the installation of untrusted software on Windows-based client machines.
Technical details
The vulnerability exists in the `DelegatedRole._is_target_in_pathpattern` function within `tuf/api/_payload.py`. It utilizes Python's `fnmatch.fnmatch`, which internally calls `os.path.normcase()`. On Windows, this causes path patterns to be lowercased, leading to case-insensitive matching that violates the TUF specification. An attacker controlling a delegated role with a case-colliding path pattern (e.g., 'Foo/*' vs 'foo/*') can intercept requests intended for a legitimate role if their role is ordered earlier in the delegation walk. This issue is specific to Windows clients and has been fixed in version 7.0.0 by switching to `fnmatch.fnmatchcase`.
Affected products
- theupdateframework tuf <= 6.0.0
Timeline
- 2026-05-18: disclosed: Advisory first published on GitHub
- 2026-05-28: advisory: Advisory reviewed and updated on GitHub
- 2026-05-28: patched: Fixed in version 7.0.0