CVE-2026-6968: Multiple Path Traversal Variants in awslabs/tough
Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copytarget/linktarget, symlinked parent directories in savetarget, or symlinked metadata filenames in SignedRole::write, because write paths trust the joined destination path without post-resolution containment verification.
We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
awslabs/toughto a version that resolves this vulnerability.Fixed in tough-v0.22.0 - Upgrade
Upgrade
awslabs/toughto a version that resolves this vulnerability.Fixed in tuftool-v0.15.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6968?
CVE-2026-6968 is classified as a medium severity vulnerability due to the potential for authenticated remote users to exploit path traversal to write files outside intended directories.
How do I fix CVE-2026-6968?
To mitigate CVE-2026-6968, upgrade to tough version 0.22.0 or later and tuftool version 0.15.0 or later.
What types of software are affected by CVE-2026-6968?
CVE-2026-6968 affects awslabs tough versions prior to 0.22.0 and awslabs tuftool versions prior to 0.15.0.
Can CVE-2026-6968 be exploited by unauthenticated users?
No, CVE-2026-6968 requires an authenticated user with delegated signing authority to exploit the vulnerability.
What are the potential consequences of exploiting CVE-2026-6968?
Exploiting CVE-2026-6968 could allow a remote authenticated user to write files outside the designated output directories, potentially compromising the application’s integrity.