GHSA-fcv2-xgw5-pqxf

Source

https://github.com/advisories/GHSA-fcv2-xgw5-pqxf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-fcv2-xgw5-pqxf/GHSA-fcv2-xgw5-pqxf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fcv2-xgw5-pqxf

Aliases

Downstream

CGA (428)

MINI (32)

Published

2026-01-22T20:28:56Z

Modified

2026-09-10T03:50:32Z

Severity

5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N CVSS Calculator

Summary

sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal

Details

Summary

The legacy TUF client pkg/tuf/client.go, which supports caching target files to disk, constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata, but it does not validate that the resulting path stays within the cache base directory.

Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. As this TUF client implementation is deprecated, users should migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf as soon as possible.

Note that this does not affect users of the public Sigstore deployment, where TUF metadata is validated by a quorum of trusted collaborators.

Impact

A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has.

Workarounds

Users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-01-22T20:28:56Z",
    "nvd_published_at":  "2026-01-23T00:15:52Z",
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/sigstore/sigstore

Package

Name: github.com/sigstore/sigstore; View open source insights on deps.dev
Purl: pkg:golang/github.com/sigstore/sigstore

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.10.4

Database specific

last_known_affected_version_range

"<= 1.10.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-fcv2-xgw5-pqxf/GHSA-fcv2-xgw5-pqxf.json"