CVE-2026-55092

Name of the Vulnerable Software and Affected Versions Trivy versions prior to 0.71.1

Description Trivy improperly trusts the org.opencontainers.image.title annotation in an OCI artifact manifest, using it as the destination filename when downloading content without proper validation or sanitization. This path traversal flaw allows an attacker to supply a crafted annotation that resolves to a path outside the intended destination. If Trivy is tricked into fetching an attacker-controlled artifact, it can result in writing layer content to an arbitrary location on the host filesystem, potentially enabling local privilege escalation, persistence, or service disruption.

Recommendations Update to version 0.71.1.