CVE-2026-63328
Received Received - Intake

Path Traversal in Trivy Security Scanner

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-63328
EUVD
EUVD-2026-60957

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aquasec trivy to 0.72.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63328 is a path traversal vulnerability in Trivy's plugin manager. It allows malicious plugins to write files outside the intended plugin directory (~/.trivy/plugins) to any user-writable location by exploiting unvalidated plugin manifest metadata. This occurs because the plugin manager does not confine file operations to the plugin root.

Detection Guidance

Check Trivy version with 'trivy version'. If version is below 0.72.0, the system is vulnerable. Inspect plugin directories (~/.trivy/plugins) for unexpected files or modifications.

Impact Analysis

An attacker could trick you into installing a malicious plugin, which may overwrite or modify files on your system. This could lead to data corruption, unauthorized changes, or disruption of services. The impact is limited to files writable by your user account and does not grant elevated privileges.

Compliance Impact

This vulnerability could lead to unauthorized file modifications, potentially violating integrity requirements in GDPR or HIPAA. If exploited, it may result in non-compliance due to unauthorized data changes or system tampering. Users should upgrade to mitigate risks.

Mitigation Strategies

Upgrade Trivy to version 0.72.0 or later. Avoid installing plugins from untrusted sources. Verify plugin sources and only use trusted official repositories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63328. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart