CVE-2026-40024: Sleuth Kit tsk_recover Path Traversal
Sleuth Kit tskrecover Path Traversal
Other sources
The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tskrecover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path traversal sequences in a filesystem image. An attacker can craft a malicious filesystem image with embedded /../ sequences in filenames that, when processed by tskrecover, writes files outside the output directory, potentially achieving code execution by overwriting shell configuration or cron entries.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sleuth Kit tsk_recoverto a version that resolves this vulnerability.Fixed in 4.14.0 - Compensating control
When using Sleuth Kit tsk_recover, process only trusted filesystem images to reduce exposure to crafted filenames/directories containing path traversal sequences (e.g., '/../') that could write outside the intended recovery directory.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40024?
CVE-2026-40024 is classified as a medium-severity path traversal vulnerability.
How do I fix CVE-2026-40024?
To fix CVE-2026-40024, upgrade the Sleuth Kit to version 4.15.0 or later.
What impact does CVE-2026-40024 have?
CVE-2026-40024 allows attackers to write files to arbitrary locations outside the intended recovery directory.
Which versions of Sleuth Kit are affected by CVE-2026-40024?
CVE-2026-40024 affects Sleuth Kit versions 4.14.0 and earlier.
What should I do if I cannot upgrade due to compatibility issues related to CVE-2026-40024?
If upgrading is not possible, it is recommended to restrict access to the vulnerable application and monitor for any unauthorized activity.