EUVD-2026-20759
GHSA-995r-jc2c-558w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCreate malicious filesystem image with path traversal sequences
-
DeliverySupply image to tsk_recover utility
-
ExploitTool writes files outside recovery directory
-
ExecutionOverwrite shell configuration or cron entries
-
ImpactExecute arbitrary code with user privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must craft a malicious filesystem image with embedded path traversal sequences (/../) in filenames. Victim must open the image with The Sleuth Kit tsk_recover tool (versions through 4.14.0). Local attacker access required; requires user interaction to process the malicious image. |
| Impact | High-severity path traversal enabling unauthenticated local file overwrite and potential code execution. Attack requires user interaction (filesystem image processing) but no authentication. Patch available mitigates immediate risk. CVSS 8.4 reflects high confidentiality and integrity impact; digital forensics tools handling untrusted images pose significant operational risk. |
| Exploit ScenarioDerived | Attacker crafts malicious filesystem image with path traversal sequences (/../) embedded in filenames. Victim processes image via tsk_recover; traversal sequences escape output directory, overwriting shell configs or cron jobs. No public exploit identified at time of analysis. Requires local access and user action. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Path traversal in The Sleuth Kit (tsk_recover) through version 4.14.0 allows local attackers to write files outside intended recovery directories via malicious filesystem images. Crafted filenames with ../ sequences in processed disk images can overwrite arbitrary files, enabling potential code execution through shell configuration or cron file manipulation. Exploitation requires user interaction (processing attacker-supplied filesystem image). No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upstream fix available via GitHub commit a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b; released patched version not independently confirmed. Apply commit patch from https://github.com/sleuthkit/sleuthkit/commit/a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b or monitor vendor for packaged release. Workaround: Restrict tsk_recover processing to trusted filesystem images only, operate tool within isolated sandbox environments with constrained write permissions, and validate recovery output paths do not traverse parent directories. Review VulnCheck advisory at https://www.vulncheck.com/advisories/sleuth-kit-tsk-recover-path-traversal for additional guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-22 path traversal vulnerability in tsk_recover utility fails to sanitize directory traversal sequences embedded within filesystem metadata. When parsing crafted images containing /../ patterns in file/directory names, the tool performs unsafe path concatenation, writing recovered files to unvalidated locations on host filesystem. CVSS vector indicates local access with required user interaction (UI:P) and unauthenticated context (PR:N).
Know when Sleuthkit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path traversal sequences in a filesystem image. An attacker can craft a malicious filesystem image with embedded /../ sequences in filenames that, when processed by tsk_recover, writes files outside the output directory, potentially achieving code execution by overwriting shell configuration or cron entries.
Executive ViewAI
The Sleuth Kit (tsk_recover) versions up to 4.14.0 contain a path traversal vulnerability that allows local attackers to write arbitrary files when processing malicious filesystem images, potentially enabling code execution. Organizations using tsk_recover for digital forensics and disk recovery should prioritize patching to prevent attackers from leveraging this capability during incident response or forensic investigations.
Apply vendor patch to version 4.15.0 or later. Until patching is complete: (1) restrict tsk_recover access to authorized forensic personnel only; (2) process only filesystem images from verified, trusted sources; (3) run tsk_recover in isolated environments without access to critical system files; (4) implement strict file permission controls limiting write access from recovery processes; (5) monitor for unexpected file modifications in system directories and shell configuration files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. Rated critical severity (CVSS 9.8), this vulnerability is remotel
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. Rated critical severity (CVSS 9.8), this vulnerability is remotel
In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a heap-based buffer over-read in ntfs_dinode_lookup in fs
An issue was discovered in libtskbase.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. Rated high severity
An issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. Rated high severity
An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. Rated high severity (
An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. Rated high severity (
autopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result i
In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file t
In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in iso9660_proc_dir() in
In The Sleuth Kit (TSK) 4.4.2, fls hangs on a corrupt exfat image in tsk_img_read() in tsk/img/img_io.c in libtskimg.a.
The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. Rated medium severity (CVSS 6.5), this vulnerability
Exploit-DB