Skip to main content

Sleuthkit EUVDEUVD-2026-20759

| CVE-2026-40024 HIGH
Path Traversal (CWE-22)
2026-04-08 VulnCheck GHSA-995r-jc2c-558w
RCE Path Traversal Sleuthkit
8.4
CVSS 4.0 · Vendor: VulnCheck
Temporal: 7.1
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.4 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CIRCL (temporal)
7.1 HIGH
cvss
SUSE
7.1 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Red Hat
7.9 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

5
Re-analysis Queued
Apr 15, 2026 - 21:07 vuln.today
cvss_changed
EUVD ID Assigned
Apr 08, 2026 - 22:01 euvd
EUVD-2026-20759
Analysis Generated
Apr 08, 2026 - 22:01 vuln.today
Patch released
Apr 08, 2026 - 22:01 nvd
Patch available
CVE Published
Apr 08, 2026 - 21:35 nvd
HIGH 8.4

DescriptionCVE.org

The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path traversal sequences in a filesystem image. An attacker can craft a malicious filesystem image with embedded /../ sequences in filenames that, when processed by tsk_recover, writes files outside the output directory, potentially achieving code execution by overwriting shell configuration or cron entries.

AnalysisAI

Path traversal in The Sleuth Kit (tsk_recover) through version 4.14.0 allows local attackers to write files outside intended recovery directories via malicious filesystem images. Crafted filenames with ../ sequences in processed disk images can overwrite arbitrary files, enabling potential code execution through shell configuration or cron file manipulation. Exploitation requires user interaction (processing attacker-supplied filesystem image). No public exploit identified at time of analysis.

Technical ContextAI

CWE-22 path traversal vulnerability in tsk_recover utility fails to sanitize directory traversal sequences embedded within filesystem metadata. When parsing crafted images containing /../ patterns in file/directory names, the tool performs unsafe path concatenation, writing recovered files to unvalidated locations on host filesystem. CVSS vector indicates local access with required user interaction (UI:P) and unauthenticated context (PR:N).

RemediationAI

Vendor-released patch: upstream fix available via GitHub commit a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b; released patched version not independently confirmed. Apply commit patch from https://github.com/sleuthkit/sleuthkit/commit/a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b or monitor vendor for packaged release. Workaround: Restrict tsk_recover processing to trusted filesystem images only, operate tool within isolated sandbox environments with constrained write permissions, and validate recovery output paths do not traverse parent directories. Review VulnCheck advisory at https://www.vulncheck.com/advisories/sleuth-kit-tsk-recover-path-traversal for additional guidance.

More in Sleuthkit

View all
CVE-2019-14532 CRITICAL POC
9.8 Aug 02

An issue was discovered in The Sleuth Kit (TSK) 4.6.6. Rated critical severity (CVSS 9.8), this vulnerability is remotel
CVE-2019-14531 CRITICAL POC
9.8 Aug 02

An issue was discovered in The Sleuth Kit (TSK) 4.6.6. Rated critical severity (CVSS 9.8), this vulnerability is remotel
CVE-2020-10233 CRITICAL POC
9.1 Mar 09

In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a heap-based buffer over-read in ntfs_dinode_lookup in fs
CVE-2018-11740 HIGH POC
8.1 Jun 05

An issue was discovered in libtskbase.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. Rated high severity
CVE-2018-11739 HIGH POC
8.1 Jun 05

An issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. Rated high severity

CVE-2018-11738 HIGH POC
8.1 Jun 05

An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. Rated high severity (
CVE-2018-11737 HIGH POC
8.1 Jun 05

An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. Rated high severity (
CVE-2018-1000838 CRITICAL
10.0 Dec 20

autopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result i
CVE-2020-10232 CRITICAL
9.8 Mar 09

In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file t
CVE-2017-13755 MEDIUM POC
5.5 Aug 29

In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in iso9660_proc_dir() in

CVE-2017-13760 MEDIUM POC
5.5 Aug 29

In The Sleuth Kit (TSK) 4.4.2, fls hangs on a corrupt exfat image in tsk_img_read() in tsk/img/img_io.c in libtskimg.a.

CVE-2019-1010065 MEDIUM
6.5 Jul 18

The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. Rated medium severity (CVSS 6.5), this vulnerability

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High

Share

EUVD-2026-20759 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy