AWS Tough EUVD-2026-25629

Exploitation requires authenticated access with delegated signing authority in a TUF repository using AWS Tough, meaning the attacker must possess valid cryptographic credentials for a delegated TUF role (typically developer, package maintainer, or CI/CD service accounts). The vulnerable code paths are triggered when repository metadata specifies absolute target names (copy_target/link_target), when parent directories in the save path contain symlinks created prior to save_target operations, or when metadata filenames are symlinks during SignedRole::write calls. Attack complexity is HIGH (AC:H) because successful exploitation requires precise control over repository metadata structure and may need specific timing for symlink-based attacks. The vulnerability is NOT exploitable by unauthenticated remote attackers or regular repository users without signing privileges. Limiting exploitation: requires network access to TUF repository infrastructure, depends on Tough library being used for repository operations (not all TUF implementations are vulnerable), and the impact scope is constrained to systems where the Tough client runs with write permissions outside the repository directory.

Real-world risk is MODERATE despite HIGH CVSS 7.1 score due to significant exploitation barriers. The CVSS:4.0 vector reveals critical limitations: Attack Complexity HIGH (AC:H) indicates non-trivial exploitation requiring specific timing or conditions, Attack Requirements PRESENT (AT:P) suggests additional prerequisites beyond network access, and Privileges Required LOW (PR:L) means attackers need authenticated access with delegated signing authority in the TUF repository - not typical low-privilege user access but a trusted role typically reserved for package maintainers or CI/CD systems. The vulnerability requires the attacker to already possess legitimate signing credentials for a delegated TUF role, significantly narrowing the threat actor pool to insider threats, compromised build systems, or supply chain attacks against signing infrastructure. EPSS data not provided but would likely be low given the authentication barrier and specialized nature of TUF implementations. No CISA KEV listing and no public POC identified, indicating no confirmed active exploitation or widespread attacker interest. The impact is severe when conditions are met (Vulnerable System Integrity HIGH, Subsequent System Integrity HIGH per CVSS 4.0 metrics), as arbitrary file writes could compromise update repository integrity or client systems downloading tampered packages. However, organizations not using AWS Tough/TUF or those without delegated signing workflows are unaffected. Priority should be HIGH for teams using Tough in production TUF repositories with role delegation, MEDIUM for those using Tough without delegation, LOW for evaluators or test deployments.

An attacker who has compromised a CI/CD system with delegated TUF signing authority creates malicious repository metadata containing a target with an absolute path like '/etc/cron.d/backdoor' in its target name field. When a Tough client processes this metadata and calls copy_target or link_target, the absolute path bypasses relative path validation, writing the attacker's payload outside the intended repository directory. Alternatively, the attacker creates a symlink in the repository's parent directory chain pointing to '/usr/local/bin', then uses save_target to write a malicious binary that gets executed by legitimate processes. The attack succeeds because the initial containment check occurs before symlink resolution, but the actual file write uses the post-resolution path without re-validation.