TUF Luck: Escaping the Sandbox in go-tuf via TAP 4 Map Files

Vulnerability ID: CVE-2026-24686

CVSS Score: 9.8

Published: 2026-01-26

A critical Path Traversal vulnerability in the go-tuf TAP 4 Multirepo client allows attackers to overwrite arbitrary files via malicious repository names in the map file.

TL;DR

The go-tuf library, widely used for secure software updates, contained a path traversal flaw in its TAP 4 support. By crafting a malicious map file with traversal sequences in repository names (e.g., "../../etc/cron.d"), an attacker can force the client to write metadata files to arbitrary locations on the host system. This turns a routine update check into an Arbitrary File Write primitive, potentially leading to RCE.

⚠️ Exploit Status: POC

Technical Details

• 
  CWE ID: CWE-22 (Path Traversal)


• 
  Attack Vector: Network / Local (Configuration)


• 
  CVSS v3.1 (Est): 9.8 (Critical)


• 
  Impact: Arbitrary File Write / RCE


• 
  Affected Component: metadata/multirepo/multirepo.go


• 
  Status: Patched

Affected Systems

• Go applications using the-update-framework/go-tuf


• Systems utilizing TAP 4 Multirepo configurations


• Supply chain security tools built on go-tuf


• 
  theupdateframework/go-tuf: < Commit d361e2ea (Fixed in: Commit d361e2ea)

Code Analysis

Commit:

Refactor Key.ID() to prevent panics (Pre-cursor work)

Exploit Details

• 
  


• for more details including interactive diagrams and full exploit analysis.
  Vollständiges Original-Advisory

  Ausführliche Details, Exploit-Analyse & Hersteller-Stellungnahme auf dev.to.

  ↗ Original-Artikel auf dev.to lesen