CVE-2026-40024

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40024
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40024.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40024
Downstream
Published
2026-04-08T21:35:20Z
Modified
2026-08-12T16:24:00Z
Severity
  • 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Sleuth Kit tsk_recover Path Traversal
Details

The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path traversal sequences in a filesystem image. An attacker can craft a malicious filesystem image with embedded /../ sequences in filenames that, when processed by tsk_recover, writes files outside the output directory, potentially achieving code execution by overwriting shell configuration or cron entries.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40024.json"
}
References

Affected packages

Git / github.com/sleuthkit/sleuthkit

Affected ranges

Type
GIT
Repo
https://github.com/sleuthkit/sleuthkit
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
01de0345edaa1ebf21dba6939a7c6bc7129e6e7d
Fixed
a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:sleuthkit:the_sleuth_kit:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.15.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

ct-3.*
ct-3.12.0
ct-3.13.0
ct-3.15.0
ct-3.5.0
ct-3.6.0
ct-3.9.0
sleuthkit-4.*
sleuthkit-4.0.2
sleuthkit-4.12.0
sleuthkit-4.14.0
sleuthkit-4.6.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40024.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "73948283954690344172360784165246666946",
            "length": 4233
        },
        "id": "CVE-2026-40024-5959fe97",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sleuthkit/sleuthkit/commit/a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b",
        "target": {
            "file": "tools/autotools/tsk_recover.cpp",
            "function": "TskRecover::writeFile"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "53909995837470360476758808154428254640",
                "225746793213793484204685123336070773139",
                "268314967259442250258740375805743177738",
                "204620620398984243189382029376371356006",
                "233226229200365408169529147808701227869",
                "277665794282598229953297890833070628955",
                "247289428205181038371230435814179388008",
                "40312942856409616152464116230173226351",
                "239325332309471041249993772184508654336",
                "6492685321797686077696005177218202882",
                "179053398931707953463459727430884617800",
                "57988799595692241695807093671879477595",
                "52494231333251921892507618077529909743",
                "49481087874895601033206978551153857586",
                "194425876693831922598245117408978803784",
                "161697777202880146678789413364204771745",
                "99014997140196969268666517209417666955",
                "261721215665269878088723576280393156860",
                "305839959399738793083939027625441478875",
                "145410694130582542980491726961195706925",
                "171757387764708134117022249907327035873",
                "83254277674121421592324317787067773184",
                "114284293973535202635451668923701243443",
                "268664309842679561844874268924372761632",
                "218378143447127038963437768610927651340",
                "249568163129437954470209067736824972409",
                "125947118316570446028756400142448281788",
                "169249611635731273505781295613221657924",
                "228177515372146144344043858524280931561",
                "187690859665707538937452923018590757678",
                "155893608755511751730457437188406795885",
                "109389031941303019430821206089673129462",
                "210780630791369675878970779878811955550",
                "182687816248276002111025257292075742403"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-40024-78e55f40",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sleuthkit/sleuthkit/commit/a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b",
        "target": {
            "file": "tools/autotools/tsk_recover.cpp"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T16:24:00Z"