CVE-2026-63328mediumCWE-22

CVE-2026-63328: medium-severity vulnerability in aquasecurity trivy

Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write

Published

Follow this CVE+ Monitor trivy+ Monitor github.com/aquasecurity/trivy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 0.2%
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
aquasecurity · trivy
Related CVEs — aquasecurity trivy

In the same product, most dangerous first.

CVE-2026-33634CRITICALTrivy ecosystem supply chain briefly compromisedEPSS 59.7%KEVCVE-2026-54448MEDIUMTrivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parserEPSS 0.4%CVE-2026-55092HIGHTrivy: Path traversal via a crafted vulnerability database or other downloaded artifactsEPSS 0.4%CVE-2024-35192MEDIUMTrivy possibly leaks registry credential when scanning images from malicious registriesEPSS 0.2%