Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-63328 · Microsoft / collected KEV context

EUVD-2026-60957

GHSA-8rc5-4fr6-64pw

GO-2026-6250

cve-program · CVE-2026-63328

• https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw
• https://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959
• https://github.com/aquasecurity/trivy/releases/tag/v0.72.0

euvd · EUVD-2026-60957

• https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw
• https://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959
• https://github.com/aquasecurity/trivy/releases/tag/v0.72.0

nvd · CVE-2026-63328

• https://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959
• https://github.com/aquasecurity/trivy/releases/tag/v0.72.0
• https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw

osv · GHSA-8rc5-4fr6-64pw

• https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw
• https://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959
• https://github.com/aquasecurity/trivy
• https://github.com/aquasecurity/trivy/releases/tag/v0.72.0

osv · GO-2026-6250

• https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw
• https://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959
• https://github.com/aquasecurity/trivy/releases/tag/v0.72.0

No related operational record is retained in the current change model.