CVE-2026-55092: Trivy Path Traversal Vulnerability in OCI Artifact Download

Technical summary

CVE-2026-55092 is a path traversal vulnerability (CWE-22) in Trivy versions prior to 0.71.1. The vulnerability exists in the OCI artifact download mechanism. Trivy extracts the org.opencontainers.image.title annotation from an OCI artifact manifest and uses it directly as a destination filename without sanitization or validation. An attacker controlling a malicious OCI artifact can embed path traversal sequences in the annotation value, causing Trivy to write layer content to paths outside the intended extraction directory. The CVSS 3.1 score of 7.5 (HIGH) reflects the network-accessible nature of the vulnerability, the lack of authentication required, and the ability to modify files on the filesystem, though without direct confidentiality impact.

Business impact

Organizations using Trivy in automated security scanning pipelines face a material risk. If Trivy is integrated into CI/CD workflows, build systems, or container registries, an attacker could potentially overwrite system configuration files, application binaries, or other critical assets by serving a malicious container image. This could lead to supply chain compromise, loss of scanning integrity, or lateral movement within the environment. The impact is amplified in containerized environments where Trivy may run with elevated privileges or in shared infrastructure.

Affected systems

Trivy versions prior to 0.71.1 are affected. Any deployment of Trivy that downloads OCI artifacts is vulnerable, including container registry scanning, CI/CD pipeline security checks, and standalone vulnerability assessments. The vulnerability is present across all platforms where Trivy runs (Linux, macOS, Windows).

Exploitability

Exploitability is moderate to high. The vulnerability requires an attacker to control or influence an OCI artifact that Trivy will download—this could occur if Trivy is configured to scan a registry namespace controlled by the attacker, or if the attacker can compromise a legitimate registry. Once the artifact is fetched, exploitation is automatic; no user interaction or special configuration is needed. The attack surface is widest in environments where Trivy scans untrusted or externally-sourced container images. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog.

Remediation

Upgrade Trivy to version 0.71.1 or later, which implements proper validation and sanitization of the org.opencontainers.image.title annotation, preventing path traversal attacks. No workarounds are available for older versions. Organizations should prioritize this patch, especially if Trivy operates in CI/CD environments or scans container images from multiple sources.

Patch guidance

Update Trivy to version 0.71.1 or later. For containerized deployments, rebuild or redeploy with the patched image. For package manager installations (apt, brew, yum, etc.), use the standard update mechanism. Verify the upgrade by running 'trivy version' and confirming the reported version is 0.71.1 or higher. No configuration changes are required; the patch is transparent to end users.

Detection guidance

Monitor Trivy logs and filesystem access patterns for evidence of unexpected file writes outside standard Trivy directories. Watch for Trivy processes attempting to write files to system paths (/etc, /usr/bin, /var, etc.) or application directories. Network monitoring can identify attempts to fetch OCI artifacts from unexpected or untrusted registries. If Trivy is instrumented with audit logging, examine for any malformed org.opencontainers.image.title annotations that contain path traversal sequences. Correlate timing of Trivy execution with filesystem modifications.

Why prioritize this

This vulnerability merits immediate attention despite not being actively exploited in the wild (no CISA KEV listing) because: (1) it enables arbitrary file write with network accessibility and no authentication, (2) Trivy is widely deployed in security-critical supply chain workflows, and (3) successful exploitation could compromise the integrity of the systems or software Trivy is meant to protect. Organizations should treat this as a high-priority patch.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a HIGH-severity vulnerability. The network vector (AV:N) indicates remote exploitability, low complexity (AC:L) means no special conditions are needed, no privilege requirement (PR:N), no user interaction (UI:N), and unchanged scope (S:U). The integrity impact (I:H) is high because arbitrary files can be written. Confidentiality and availability impacts are not directly affected, explaining why the score does not reach critical. The practical risk is elevated by Trivy's role in securing supply chains.

Frequently asked questions