{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63328", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-16T14:14:24.384Z", "datePublished": "2026-08-18T15:14:21.879Z", "dateUpdated": "2026-08-18T15:48:40.395Z"}, "containers": {"cna": {"title": "Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw"}, {"name": "https://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959", "tags": ["x_refsource_MISC"], "url": "https://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959"}, {"name": "https://github.com/aquasecurity/trivy/releases/tag/v0.72.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/aquasecurity/trivy/releases/tag/v0.72.0"}], "affected": [{"vendor": "aquasecurity", "product": "trivy", "versions": [{"version": "< 0.72.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T15:14:21.879Z"}, "descriptions": [{"lang": "en", "value": "Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0."}], "source": {"advisory": "GHSA-8rc5-4fr6-64pw", "discovery": "UNKNOWN"}, "x_gcve": [{"vulnId": "CVE-2026-63328", "recordType": "advisory"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-18T15:48:35.086779Z", "id": "CVE-2026-63328", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T15:48:40.395Z"}}]}, "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2026-63328", "date": "2026-11-08", "epss": "0.0019", "percentile": "0.0868"}, "nvd": "{\"cve\":{\"id\":\"CVE-2026-63328\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-18T16:18:12.387\",\"lastModified\":\"2026-10-22T22:10:00.250\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.\"},{\"lang\":\"es\",\"value\":\"Trivy es un esc\u00e1ner de seguridad. Antes de la versi\u00f3n 0.72.0, los metadatos del manifiesto del plugin son utilizados por pkg/plugin/manager.go para construir rutas bajo ~/.trivy/plugins sin confinar los nombres de los plugins a esa ra\u00edz, permitiendo a un atacante que persuade a un usuario para instalar o ejecutar un plugin malicioso escribir el manifiesto y el binario del plugin en rutas arbitrarias donde el usuario tenga permisos de escritura, mientras que los plugins del \u00edndice oficial de plugins de Trivy no se ven afectados. Este problema est\u00e1 solucionado en la versi\u00f3n 0.72.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"aquasecurity\",\"product\":\"trivy\",\"versions\":[{\"version\":\"< 0.72.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":6.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-18T15:48:35.086779Z\",\"id\":\"CVE-2026-63328\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/aquasecurity/trivy/releases/tag/v0.72.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw\",\"source\":\"security-advisories@github.com\"}]}}", "redhat_vex": {"aggregate_severity": "Moderate", "current_release_date": "2026-10-08T14:38:54+00:00", "cve": "CVE-2026-63328", "id": "CVE-2026-63328", "initial_release_date": "2026-08-18T15:14:21.879000+00:00", "product_status:known_not_affected": "1", "source": "Red Hat CSAF VEX", "status": "final", "title": "github.com/aquasecurity/trivy: Trivy: Path Traversal allows arbitrary file write via malicious plugin", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63328.json", "version": "3"}}}