Skip to main content

Github CVE-2026-24137

MEDIUM
Path Traversal (CWE-22)
2026-01-23 security-advisories@github.com GHSA-fcv2-xgw5-pqxf
Github Golang Red Hat Suse
5.8
CVSS 3.1 · GitHub Advisory
View

Vulnerability Assessment

Weakness
CWE
CWE-22
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK

2 techniques across 2 tactics: Discovery, Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

CVSS 5.8 (MEDIUM). Attack vector: Network. Complexity: High. Privileges required: High. User interaction: None.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to compromise the affected system.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

The Golang sigstore framework versions 1.10.3 and below fail to validate cache directory paths in the legacy TUF client, allowing a malicious TUF repository to overwrite arbitrary files on disk within the calling process's permission scope. This impacts direct users of the TUF client in sigstore/sigstore and older Cosign versions, though public Sigstore deployments are protected by metadata validation from trusted collaborators. No patch is currently available for this medium-severity path traversal vulnerability.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:54 CVSS 5.8

sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. [CVSS 5.8 MEDIUM]

RemediationAI

Fixed in version 1.10.4.. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.

Affected Packages

go github.com/sigstore/sigstore fix: 1.10.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in go

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-22 (Path Traversal). sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permi

Know when Github gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 5.8 MEDIUM
AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
SUSE MEDIUM
Red Hat 5.8 MEDIUM

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Jan 23, 2026 - 00:15 nvd
MEDIUM 5.8

DescriptionGitHub Advisory

sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.

Executive ViewAI

Why It Matters

Organizations using sigstore framework should be aware of moderate risk from CVE-2026-24137, a path traversal vulnerability rated CVSS 5.8. This could allow unauthorized file access. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: restrict file access via WAF, implement allowlists.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
Low

Priority Score

29
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +29
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

More in Github

View all
CVE-2026-1699 CRITICAL POC
10.0 Jan 30

Supply chain vulnerability in Eclipse Theia GitHub Actions workflow. The preview.yml workflow uses pull_request_target w
CVE-2026-27941 CRITICAL POC
9.9 Feb 26

Supply chain attack vector in OpenLIT GitHub Actions workflows. The pull_request_target trigger with checkout enables ma
CVE-2026-22869 CRITICAL POC
9.8 Jan 13

Eigent multi-agent workflow CI pipeline (ci.yml) uses pull_request_target with checkout of untrusted PR code, enabling a
CVE-2024-0200 CRITICAL POC
9.8 Jan 16

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. R
CVE-2022-24724 CRITICAL POC
9.8 Mar 03

cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Rated critical severity (CVSS 9.
CVE-2024-9487 CRITICAL POC
9.5 Oct 10

An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowe
CVE-2026-28215 CRITICAL POC
9.1 Feb 26

Unauthenticated infrastructure overwrite in Hoppscotch API development ecosystem before 2026.2.0. Attackers can overwrit
CVE-2018-1000600 HIGH POC
8.8 Jun 26

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCrede
CVE-2026-30920 HIGH POC
8.6 Mar 10

OneUptime versions prior to 10.0.19 allow unauthenticated attackers to hijack GitHub App integrations across projects by
CVE-2026-25221 HIGH POC
8.1 Feb 02

PolarLearn versions 0-PRERELEASE-15 and earlier lack proper state parameter validation in OAuth 2.0 authentication, enab
CVE-2026-23644 HIGH POC
7.5 Jan 18

Path traversal in esm.sh CDN prior to version 0.0.0-20260116051925-c62ab83c589e allows unauthenticated remote attackers

CVE-2024-42471 HIGH POC
7.5 Sep 02

actions/artifact is the GitHub ToolKit for developing GitHub Actions. Rated high severity (CVSS 7.5), this vulnerability

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Image SL-Micro Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
openSUSE Leap 15.6 Fixed
openSUSE Leap 16.0 Fixed

References

Advisories & patches
ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0592/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0757/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0777/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20904/ REF https://github.com/sigstore/sigstore/commit/8ec410a2993ea78083aecf0e473a85453039496e REF https://github.com/sigstore/sigstore/releases/tag/v1.10.4 REF https://github.com/sigstore/sigstore/security/advisories/GHSA-fcv2-xgw5-pqxf

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy