GHSA-v57p-gppj-p9vg: Multiple Path Traversal Variants in awslabs/tough
Published Apr 24, 2026
·Updated
Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copytarget/linktarget, symlinked parent directories in savetarget, or symlinked metadata filenames in SignedRole::write, because write paths trust the joined destination path without post-resolution containment verification.
We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.
Affected Software
2 affected components
AWS tough<0.22.0
AWS tuftool<0.15.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
awslabs/toughto a version that resolves this vulnerability.Fixed in v0.22.0 - Upgrade
Upgrade
tuftoolto a version that resolves this vulnerability.Fixed in v0.15.0
Event History
Apr 24, 2026
CVE Published
via OSV·07:44 PM
Data Sourced
via OSV·07:44 PM
DescriptionSeverityWeakness