CVE-2026-24137

[CVE catalog]

Severity

Medium · CVSS 5.8CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

Published

Jan 22, 2026, 8:28:56 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.39% · Oct 27, 2026

A path traversal flaw has been discovered in the sigstore go library. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. github.com/sigstore/sigstore: sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.