CVE-2026-63328 in Trivy
Summary
by MITRE • 08/18/2026
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in versions of Trivy prior to 0.72.0 represents a critical path traversal and arbitrary file write flaw within the plugin management subsystem. Specifically, the defect resides in the pkg/plugin/manager.go module, which is responsible for handling plugin installation and execution metadata. When a user installs or runs a plugin from an external source rather than the official Trivy plugin index, the system utilizes the manifest metadata provided by that plugin to construct file paths under the ~/.trivy/plugins directory. The core technical flaw lies in the lack of strict validation on the plugin name field within this metadata. Instead of sanitizing or constraining the input to ensure it remains a valid filename component, the code directly incorporates potentially malicious path sequences into the target location string.
This architectural oversight allows an attacker who can persuade a victim to install or execute a specially crafted malicious plugin to manipulate the file system write operations. By embedding directory traversal characters such as ../ in the plugin name metadata, the attacker can break out of the intended ~/.trivy/plugins sandbox and specify arbitrary paths on the host operating system that are writable by the user running Trivy. This capability effectively transforms what appears to be a standard plugin installation process into an arbitrary file write vulnerability. The impact is severe because it enables lateral movement within the local environment, potential privilege escalation if combined with other vulnerabilities, or the planting of malicious scripts and binaries in locations where they may be executed by automated processes or loaded by subsequent applications.
From a threat modeling perspective, this flaw aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as it fails to restrict file operations within expected boundaries. Furthermore, the attack vector corresponds to ATT&CK technique T1059 Command and Scripting Interpreter if the written files are executable scripts, or T1105 Ingress Tool Transfer combined with T1204 User Execution when considering how the initial malicious plugin is introduced via social engineering or compromised repositories. It is important to note that this vulnerability does not affect plugins sourced from the official Trivy plugin index, as those undergo stricter validation and trust verification processes before installation. The risk is primarily associated with third-party or user-contributed plugins where metadata integrity cannot be guaranteed by a central authority.
Mitigation for this issue requires immediate upgrading to version 0.72.0 or later, which implements proper path canonicalization and strict input validation on plugin names during the manifest parsing phase. Organizations relying on Trivy should audit their CI/CD pipelines and local development environments to ensure that no custom plugins with unverified metadata are being installed automatically. Additionally, implementing least-privilege principles for user accounts running security scanners can limit the blast radius of such file write operations. Security teams should also enforce strict allow-listing policies for plugin sources to prevent the installation of unsigned or unvetted extensions from external registries until trust relationships are established and validated through cryptographic signatures.