GO-2026-6294

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-6294

Import Source

https://vuln.go.dev/ID/GO-2026-6294.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-6294

Aliases

Downstream

CGA-53wf-3jpc-8mr6

CGA-hc4x-fcc9-95m3

CGA-jfpg-3pxj-whmv

CGA-mww6-j8fr-mhrf

CGA-rcx7-fwp3-4p67

CGA-v3v9-r6g6-58hc

CGA-wg36-p2rm-7j4g

CGA-xfw7-p345-2jgr

Related

CGA-87j8-vm8f-62rm

Published

2026-08-26T14:57:44Z

Modified

2026-08-28T04:10:58Z

Summary

Path traversal via crafted vulnerability database or other downloaded artifacts in github.com/aquasecurity/trivy

Details

Path traversal via crafted vulnerability database or other downloaded artifacts in github.com/aquasecurity/trivy

Database specific

{
    "review_status": "UNREVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6294"
}

References

Affected packages

Go / github.com/aquasecurity/trivy

Package

Name: github.com/aquasecurity/trivy; View open source insights on deps.dev
Purl: pkg:golang/github.com/aquasecurity/trivy

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.71.1

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/aquasecurity/trivy/pkg/oci",
            "symbols": [
                "Artifact.Download",
                "Artifacts.Download"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6294.json"