Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 20:01:05 +0000 CVE-2026-6968 — Multiple Path Traversal Variants in awslabs/tough https://cve.radiocsirt.org/vuln/cve-2026-6968 <p><strong>Affected:</strong> AWS tough, AWS tuftool</p> <p>Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copy_target/link_target, symlinked parent directories in save_target, or symlinked metadata filenames in SignedRole::write, because write paths trust the joined destination path without post-resolution containment verification.</p> <p>We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.</p> <p><strong>Affected:</strong> AWS tough, AWS tuftool</p> <p>Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copy_target/link_target, symlinked parent directories in save_target, or symlinked metadata filenames in SignedRole::write, because write paths trust the joined destination path without post-resolution containment verification.</p> <p>We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-6968