4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24686

CVE-2026-24686: go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names

go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (repoName) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a repoName containing traversal (e.g., ../escaped-repo) and cause go-tuf to create directories and write the root metadata file outside the intended LocalMetadataDir cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24686

CVE-2026-24686:

4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/theupdateframework/go-tuf/v2	go	< 2.4.1	2.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal in the go-tuf library's TAP 4 Multirepo Client. An attacker can provide a specially crafted repository name in a map file, which is then used to construct a file path. The lack of validation on the repository name allows for path traversal characters (../), leading to arbitrary file writes on the system, constrained by the permissions of the running process.

The analysis of the patch d361e2ea24e427581343dee5c7a32b485d79fcc0 reveals the fix. A new function, validateRepoName, is introduced to sanitize the repository names using a regular expression. This validation is performed within the New function before the client initialization process begins.

The core of the vulnerability lies in the initTUFClients method, which, according to the vulnerability description, uses the unsanitized repoName in a filepath.Join operation. The patch confirms this by adding the sanitization step in the New function, which is the entry point for creating a MultiRepoClient and subsequently calls initTUFClients.

Therefore, two functions are identified as relevant for a runtime profile during exploitation:

multirepo.(*MultiRepoClient).initTUFClients: This is the function where the path traversal occurs. It takes the malicious repoName and uses it to construct a file path, leading to the arbitrary file write.
multirepo.New: This function orchestrates the creation of the multirepo client and was modified to include the fix. In a vulnerable version, it would call initTUFClients with the unsanitized, malicious repoName.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.