Описание
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.
A flaw was found in Trivy, a security scanner. The plugin manager does not properly confine plugin names to their designated root directory. This allows an attacker, by persuading a user to install or run a malicious plugin, to write the plugin manifest and binary to arbitrary user-writable paths. This could lead to unauthorized file modification on the system.
Отчет
This vulnerability is rated as Moderate impact because successful exploitation requires active user interaction to install an untrusted third-party plugin, and file write actions remain limited to the operating system permissions of the executing user account. Standard CLI scanning operations do not require or automatically fetch external plugins, leaving automated CI/CD and container inspection workflows unimpacted. Additionally, plugins distributed through the official Trivy plugin index are unaffected.
Меры по смягчению последствий
Avoid installing or executing Trivy plugins from untrusted sources. Limit plugin usage to verified plugins from the official Trivy plugin index, or refrain from using third-party plugins in automated scanning pipelines. Running scans within an isolated container with read-only filesystem mounts prevents unauthorized file creation outside expected directories.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | trivy | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.6 Medium
CVSS3
Связанные уязвимости
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata ...
Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write
ALT-PU-2026-18880: package `trivy` update to version 0.75.0-alt1
EPSS
6.6 Medium
CVSS3