关键漏洞信息 漏洞标题 Legacy TUF client allows for arbitrary file writes with target cache path traversal 漏洞等级 Moderate 影响版本 <= 1.10.3 修复版本 1.10.4 描述 Summary: The legacy TUF client , which supports caching target files to disk, constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata, but it does not validate that the resulting path stays within the cache base directory. Impact: A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Workarounds: - Users can disable disk caching for the legacy client by setting in the environment. - Migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf. - Upgrade to the latest sigstore/sigstore release. CVSS v3 基准指标 Attack Vector: Network Attack Complexity: High Privileges Required: High User Interaction: None Scope: Changed Confidentiality: None Integrity: High Availability: None CVE ID CVE-2026-24137 弱点 CWE-22