What is CVE-2026-55092?

CVE-2026-55092 is a high-severity vulnerability in Aquasec Trivy, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-06-25.

How severe is CVE-2026-55092?

High severity. CVSS v3 base score is 7.5 out of 10.

Path Traversal in Aquasec Trivy

CVE-2026-55092

Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make T…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.003 (21.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Aquasec Trivy
Aquasecurity Trivy — versions < 0.71.1

Weakness classification (CWE)

CWE-22 — Path Traversal

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2026-55092?: CVE-2026-55092 is a high-severity vulnerability in Aquasec Trivy, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-06-25.
How severe is CVE-2026-55092?: High severity. CVSS v3 base score is 7.5 out of 10.