CVE catalog
CVE-2026-55092
Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without
- Severity
- High · CVSS 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.44% · Oct 25, 2026
Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a path outside the intended destination, causing Trivy to write the layer content to an arbitrary location on the host filesystem. This vulnerability is fixed in 0.71.1.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | trivy | Not reported | 0.71.1 | fixed |
| Go | github.com/aquasecurity/trivy | Not reported | 0.71.1 | fixed |
| Cpe | trivy | Not reported | 0.71.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | trivy | cpe | Not reported | 0.71.1 | Not reported | Not reported | Not reported |
| Go | github.com/aquasecurity/trivy | go | Not reported | 0.71.1 | Not reported | GHSA-MCJ4-MPHF-J9FF | Not reported |
| Cpe | trivy | cpe | Not reported | 0.71.1 | Not reported | NVD-CVE-2026-55092 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11162-1.json]
- [https://github.com/advisories/GHSA-mcj4-mphf-j9ff]
- [https://github.com/aquasecurity/trivy/security/advisories/GHSA-mcj4-mphf-j9ff]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-55092]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1924.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [SUSE security advisories and VEX]