EUVD-2026-25629Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copy_target/link_target, symlinked parent directories in save_target, or symlinked metadata filenames in SignedRole::write, because write paths trust the joined destination path without post-resolution containment verification.
We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.
Articles & Coverage 1
AnalysisAI
Path traversal vulnerabilities in AWS Tough (a Rust TUF client library) versions prior to 0.22.0 enable authenticated users with delegated signing privileges to write arbitrary files outside intended repository directories, bypassing incomplete fixes from previous security patches. The flaws exist in three distinct code paths: absolute target names in copy_target/link_target operations, symlinked parent directories in save_target, and symlinked metadata filenames in SignedRole::write. AWS has released patches in tough-v0.22.0 and tuftool-v0.15.0 that implement post-resolution path containment verification. No public exploit code or active exploitation confirmed at time of analysis, though CVSS 7.1 HIGH reflects significant integrity impact when exploited.
Technical ContextAI
AWS Tough is a Rust implementation of The Update Framework (TUF), a security framework for software update systems that uses cryptographic signatures and role-based delegation. TUF clients download metadata and target files from repositories while verifying signatures from delegated roles. The vulnerability stems from classic TOCTOU (time-of-check-time-of-use) race conditions in file operations: the code validates that a destination path is within allowed boundaries before symlink resolution, but then writes to the resolved path without re-validating containment. This affects three distinct operations: copy_target and link_target accept absolute paths in target names that bypass relative path validation; save_target follows symlinked parent directories after initial validation; and SignedRole::write trusts symlinked metadata filenames. The root cause maps to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), specifically the variant where symbolic link resolution occurs after boundary checks. The description notes these are 'incomplete path traversal fixes,' indicating prior CVEs addressed similar issues but missed these attack vectors, suggesting the codebase had partial mitigations that failed under specific conditions.
RemediationAI
Upgrade to AWS Tough 0.22.0 or later and AWS Tuftool 0.15.0 or later, available from GitHub releases (https://github.com/awslabs/tough/releases/tag/tough-v0.22.0 and https://github.com/awslabs/tough/releases/tag/tuftool-v0.15.0) and crates.io (https://crates.io/crates/tough/0.22.0 and https://crates.io/crates/tuftool/0.15.0). The patches implement post-resolution path containment checks that verify destination paths remain within intended directories after symlink resolution. If immediate patching is not feasible, implement compensating controls: restrict delegated signing authority to minimal necessary roles and principals, audit existing delegated role credentials and revoke unnecessary permissions, run TUF repository operations in isolated containers with read-only filesystem mounts outside target directories to limit traversal impact, and monitor file write operations for unexpected paths outside repository boundaries using filesystem audit tools like auditd or osquery (noting this adds operational overhead and may not prevent exploitation, only detect it). Review TUF repository metadata for unauthorized modifications if delegated signers had access during the vulnerability window. These workarounds reduce attack surface but do not eliminate the vulnerability - prioritize vendor-released patches.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated a
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary
Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies pa
A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local us
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to
Command injection in Amazon ECS Agent on Windows allows authenticated attackers with task definition permissions to exec
Security-policy bypass in the awslabs AWS API MCP Server (versions 0.2.13 through 1.3.46) lets an actor invoke AWS API o
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today