{"id":"EUVD-2026-60957","enisaUuid":"5872941b-6885-3ef8-8711-6b442427ea50","description":"Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.","datePublished":"Aug 18, 2026, 3:14:21 PM","dateUpdated":"Aug 18, 2026, 3:48:40 PM","baseScore":6.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw\nhttps://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959\nhttps://github.com/aquasecurity/trivy/releases/tag/v0.72.0\n","aliases":"CVE-2026-63328\nGHSA-8rc5-4fr6-64pw\n","assigner":"GitHub_M","epss":0.19,"enisaIdProduct":[{"id":"4d2f781c-8191-31a6-bb0e-657b907b3214","product":{"name":"trivy","vendor":{"name":"aquasecurity"}},"product_version":"\u003c 0.72.0"}],"enisaIdVendor":[{"id":"52c67ef3-039c-3408-8325-c19d80491326","vendor":{"name":"aquasecurity"}}],"enisaIdVulnerability":[{"id":"0fc9ec4a-96ce-3833-bf10-b59577ebe393","vulnerability":{"id":"CVE-2026-63328","description":"Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.","datePublished":"Aug 18, 2026, 3:14:21 PM","dateUpdated":"Aug 18, 2026, 3:48:40 PM","status":"PUBLISHED","baseScore":6.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw\nhttps://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959\nhttps://github.com/aquasecurity/trivy/releases/tag/v0.72.0\n","enisa_id":"EUVD-2026-60957\n","assigner":"GitHub_M","epss":0.19,"dataProcessed":"Oct 30, 2026, 7:15:53 AM","vulnerabilityProduct":[{"id":"0eba0ce3-386e-3d09-9818-84d6880af69c","product":{"name":"trivy","vendor":{"name":"aquasecurity"}},"product_version":"\u003c 0.72.0"}],"vulnerabilityVendor":[{"id":"b2dabc1c-c0a5-3cdf-aa2f-ba8a9d1d6ed6","vendor":{"name":"aquasecurity"}}]}},{"id":"9dacfd6a-077d-333d-b71a-0f116bd68367","vulnerability":{"id":"GHSA-8rc5-4fr6-64pw","description":"Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write","datePublished":"Aug 18, 2026, 4:32:02 PM","dateUpdated":"Aug 18, 2026, 4:32:02 PM","baseScore":0.0,"references":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw\nhttps://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959\nhttps://github.com/aquasecurity/trivy\nhttps://github.com/aquasecurity/trivy/releases/tag/v0.72.0\n","enisa_id":"EUVD-2026-60957\n","aliases":"CVE-2026-63328\nGHSA-8rc5-4fr6-64pw\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:59:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}