Trivy CVE-2026-55092

Exploitation requires that an attacker can cause Trivy (a version prior to 0.71.1) to fetch an attacker-controlled OCI artifact - for example by hosting it in a registry the victim pulls from or by poisoning an artifact reference - and that the victim actively runs Trivy to download/scan that artifact (CVSS UI:A). The specific trigger is the org.opencontainers.image.title manifest annotation containing a traversal or absolute path; without control over that annotation value there is no exploit. Limiting factors: required user interaction (the scan must be initiated against the malicious artifact), and that organizations restricting Trivy to trusted internal registries are not realistically exposed. No authentication on the target host is needed and no special target-side configuration flag beyond normal OCI-artifact fetching behavior is required.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H) scores 7.0 and is internally consistent with the description: network-reachable artifact fetch, low complexity, no privileges, but Active user interaction (UI:A) because a victim must run Trivy against the malicious artifact. Impact is integrity-high and availability-high with no confidentiality loss - matching an arbitrary file-write that can corrupt or overwrite files but does not directly disclose data. No KEV listing and no POC are present in the supplied intelligence, and no EPSS score was provided, so realistic exploitation likelihood cannot be quantified from the data - this should be treated as a credible but not confirmed-exploited issue. The UI:A requirement is the main limiting factor: an attacker cannot trigger it passively but must induce a victim to scan a malicious or compromised artifact reference, which is plausible in supply-chain or poisoned-registry scenarios. Overall this is a legitimate priority for environments that pull OCI artifacts from untrusted or shared registries, but lower urgency where Trivy only fetches from trusted, controlled sources.

An attacker publishes or compromises an OCI artifact in a registry and sets its org.opencontainers.image.title annotation to a value like ../../../../etc/cron.d/payload. A developer or CI job runs Trivy to pull and scan that artifact, and Trivy writes the layer content to the attacker-chosen path outside the intended directory, potentially overwriting a configuration file or dropping a file that leads to code execution. No public POC is identified at time of analysis, and the attack succeeds only because the victim actively initiates the scan (UI:A).