CVE-2026-6968— Multiple Path Traversal Variants in awslabs/tough
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-6968
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Multiple Path Traversal Variants in awslabs/tough
Source: NVD (National Vulnerability Database)
Vulnerability Description
Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copy_target/link_target, symlinked parent directories in save_target, or symlinked metadata filenames in SignedRole::write, because write paths trust the joined destination path without post-resolution containment verification. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Amazon tough 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Amazon tough是美国亚马逊（Amazon）公司的 一个The Update Framework（TUF） 存储库的 Rust 客户端库。 tough tough-v0.22.0之前版本存在路径遍历漏洞，该漏洞源于路径遍历修复不完整，可能导致远程认证用户通过绝对目标名称、符号链接父目录或符号链接元数据文件名写入预期输出目录之外的文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-6968
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-6968
请登录查看更多情报信息。
- Issues in tough library and tuftool CLI utilityvendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-6968
Same Patch Batch · AWS · 2026-04-24 · 5 CVEs total
| CVE-2026-6911 | 9.8 CRITICAL | Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel |
| CVE-2026-6912 | 8.8 HIGH | Privilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops Wheel |
| CVE-2026-6967 | 5.9 MEDIUM | Missing Delegated Metadata Validation in awslabs/tough |
| CVE-2026-6966 | 5.3 MEDIUM | Signature Threshold Bypass in awslabs/tough Delegated Roles |
IV. Related Vulnerabilities
Same product: tough
- CVE-2026-6967
Missing Delegated Metadata Validation in awslabs/tough - CVE-2026-6966
Signature Threshold Bypass in awslabs/tough Delegated Roles - CVE-2025-2888
Improper timestamp caching during snapshot rollback in tough - CVE-2025-2887
Failure to detect delegated target rollback in tough - CVE-2025-2886
Terminating targets role delegations are not respected in to
Same vendor: AWS
- CVE-2026-7461
OS Command Injection in Amazon ECS Agent via FSx Windows Fil - CVE-2026-7426
Out-of-Bounds Write via Unsanitized Prefix Length in Router - CVE-2026-7425
Out-of-Bounds Read in Router Advertisement Option Parser in - CVE-2026-7424
Integer Underflow in DHCPv6 Sub-Option Parser in FreeRTOS-Pl - CVE-2026-7423
Integer Underflow in ICMP Echo Reply Processing in FreeRTOS-
Same weakness: CWE-22
- CVE-2026-8274
npitre cramfs-tools Directory cramfsck.c do_directory path t - CVE-2022-50956
WordPress Plugin amministrazione-aperta 3.7.3 Local File Rea - CVE-2026-8215
Industrial Application Software IAS Canias ERP RMI iasReques - CVE-2026-42605
AzuraCast: Path Traversal in `currentDirectory` Parameter En - CVE-2026-42574
apko dirFS has a symlink-following path traversal that allow
V. Comments for CVE-2026-6968
No comments yet