CVE-2026-40024

Katalog CVE

CVSS 7.1 · High EPSS 0,21%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada sleuthkit the sleuth kit. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path traversal sequences in a filesystem image. An attacker can craft a malicious filesystem image with embedded /../ sequences in filenames that, when processed by tsk_recover, writes files outside the output directory, potentially achieving code execution by overwriting shell configuration or cron entries.

Rincian

Terbit di NVD

8 April 2026

Terakhir diubah

25 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sleuthkit/sleuthkit/commit/a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b patch
• https://mobasi.ai/sentinel advisory pihak ketiga
• https://www.vulncheck.com/advisories/sleuth-kit-tsk-recover-path-traversal advisory pihak ketiga