Which versions of Trivy are affected by CVE-2026-55092?

Aqua Security's Trivy scanner versions prior to 0.71.1 contain a critical path-traversal vulnerability (CVE-2026-55092, CVSS 7.0) that enables arbitrary file writes to the host filesystem through…. A patch is available.

How to fix or mitigate CVE-2026-55092?

Within 24 hours: Inventory all Trivy deployments and document current versions in use. Within 7 days: Upgrade all instances to Trivy 0.71.1 or later, prioritizing production scanning infrastructure and systems handling untrusted artifacts. Within 30 days: Verify upgrade completion across all environments and confirm scanning operations resume normally.

Trivy CVE-2026-55092

Q: What is the CVSS score of CVE-2026-55092?

CVE-2026-55092 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39477 HIGH

Path Traversal (CWE-22)

2026-06-25 GitHub_M

GHSA-mcj4-mphf-j9ff

Path Traversal Trivy Suse

7.0

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Remote attacker-controlled artifact fetched over the network with low complexity and no privileges, but the victim must run the scan (UI:R); arbitrary file write yields high integrity/availability impact and no confidentiality loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 18:03 EUVD

Analysis Generated

Jun 25, 2026 - 17:20 vuln.today

DescriptionCVE.org

Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a path outside the intended destination, causing Trivy to write the layer content to an arbitrary location on the host filesystem. This vulnerability is fixed in 0.71.1.

AnalysisAI

Arbitrary file write in Aqua Security's Trivy scanner (prior to 0.71.1) allows an attacker who can make Trivy fetch an attacker-controlled OCI artifact to write layer content anywhere on the host filesystem. Trivy trusts the org.opencontainers.image.title manifest annotation as the output filename without sanitization, so a crafted value containing path-traversal sequences escapes the intended download directory (CWE-22). No public exploit has been identified at time of analysis; the CVSS 4.0 score is 7.0 (high), driven by high integrity and availability impact requiring user interaction.

Technical ContextAI

Trivy is an open-source vulnerability and misconfiguration scanner (cpe:2.3:a:aquasecurity:trivy) widely used in CI/CD pipelines, container registries, and developer workflows. It can retrieve OCI (Open Container Initiative) artifacts - for example databases, plugins, or modules distributed over registries - whose manifests carry standardized annotations. The org.opencontainers.image.title annotation is an OCI-spec-defined, human-readable title for an artifact layer; Trivy reused this attacker-influenceable string directly as the on-disk destination filename. Because the value is taken from the remote manifest without validating or canonicalizing the resulting path, embedding sequences such as ../ or an absolute path lets the write escape the intended directory. This is a classic CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), specifically an arbitrary-file-write variant where the traversal controls where downloaded bytes land rather than what is read.

RemediationAI

Vendor-released patch: upgrade Trivy to 0.71.1 or later, which adds validation of the OCI artifact destination path; this is the primary and recommended fix, documented in advisory GHSA-mcj4-mphf-j9ff (https://github.com/aquasecurity/trivy/security/advisories/GHSA-mcj4-mphf-j9ff). Where immediate upgrade is not possible, restrict Trivy to fetching OCI artifacts only from trusted, access-controlled registries and avoid scanning artifacts from untrusted or user-supplied references - this removes the attacker's ability to deliver a crafted manifest but reduces flexibility in multi-tenant or community-registry workflows. As a further compensating control, run Trivy as a low-privilege, non-root user inside a sandboxed or containerized context with a read-only host filesystem except for a dedicated scratch directory, limiting where an arbitrary write can land at the cost of some operational overhead. Verify the integrity and provenance of any OCI artifacts (signing/attestation) before allowing Trivy to download them.