CVE-2026-40024: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-40024 is a path traversal vulnerability in The Sleuth Kit's tsk_recover utility that allows an attacker to write files to arbitrary locations outside the intended recovery directory. It affects The Sleuth Kit through version 4.14.0. The vulnerability was published on April 8, 2026, and was reported by Mobasi. It carries a CVSS v3.1 base score of 7.1 (High) and a CVSS v4.0 base score of 8.4 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), where tsk_recover fails to sanitize path traversal sequences (e.g., /../) embedded in filenames or directory paths within a filesystem image before writing recovered files to disk (Github Advisory). An attacker crafts a malicious filesystem image containing filenames with embedded /../ sequences; when a user processes this image with tsk_recover, the tool writes files outside the designated output directory without adequate validation. The fix, committed to the sleuthkit repository, adds explicit checks to replace path separator characters and /../ sequences with safe substitutes (^) in both the path and filename components of the writeFile function (Patch Commit). Exploitation requires user interaction — specifically, a user must process the malicious filesystem image — and operates on a local attack vector with no privileges required.

Successful exploitation allows an attacker to write arbitrary files to any location accessible by the user running tsk_recover, resulting in high integrity and confidentiality impact with no direct availability impact (Github Advisory). The most severe consequence is potential code execution achieved by overwriting sensitive files such as shell configuration files (e.g., .bashrc, .bash_profile) or cron job entries, which would execute attacker-controlled commands in the context of the victim user (Red Hat Bugzilla). This vulnerability is particularly relevant in digital forensics and incident response environments where analysts routinely process untrusted filesystem images from potentially adversarial sources.

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.031% (9th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (processing a malicious filesystem image) and is limited to a local attack vector, which reduces the overall exploitability compared to remotely triggerable vulnerabilities.

1. Craft a malicious filesystem image: Using filesystem creation tools (e.g., mkfs, custom scripts, or raw image editors), create a filesystem image containing files with path traversal sequences embedded in their names or directory paths, such as ../../../../home/user/.bashrc or ../../../../etc/cron.d/malicious.
2. Embed a malicious payload: Place attacker-controlled content (e.g., a reverse shell command or cron job entry) as the file content within the crafted filesystem image.
3. Deliver the image to the victim: Social-engineer or otherwise provide the malicious filesystem image to a forensic analyst or system administrator who uses The Sleuth Kit for file recovery tasks.
4. Victim processes the image: The victim runs tsk_recover <malicious_image> <output_dir> on a system running The Sleuth Kit ≤ 4.14.0.
5. Path traversal triggers file write: tsk_recover processes the embedded filenames without sanitizing the /../ sequences, causing it to write the attacker's payload file to the targeted path outside the output directory (e.g., overwriting ~/.bashrc).
6. Achieve code execution: The next time the victim user opens a shell or the cron daemon processes the overwritten entry, the attacker's payload executes in the context of the victim user (Red Hat Bugzilla, Patch Commit).

• File System: Unexpected or recently modified files in user home directories (e.g., .bashrc, .bash_profile, .profile) or cron directories (e.g., /etc/cron.d/, /var/spool/cron/) with timestamps correlating to tsk_recover execution; files written outside the intended tsk_recover output directory.
• Logs: Shell history or audit logs showing tsk_recover invoked with an external or untrusted filesystem image; file integrity monitoring alerts on sensitive configuration files modified around the time of tsk_recover execution.
• Process: Unexpected processes spawned from shell sessions shortly after tsk_recover completes, particularly if shell configuration files were overwritten; unusual cron job executions by user accounts that run forensic tools.

Update The Sleuth Kit to version 4.15.0 or later, which includes the patch that sanitizes path traversal sequences in the tsk_recover writeFile function (Patch Commit). Until patching is complete, avoid processing filesystem images from untrusted or unverified sources with tsk_recover. Additional mitigations include running tsk_recover with minimal necessary privileges (e.g., as a dedicated low-privilege user), using file integrity monitoring on critical system directories to detect unauthorized modifications, and restricting access to tsk_recover to trusted personnel only (Red Hat Bugzilla).

The vulnerability was reported to the sleuthkit project by Mobasi, as noted in the patch commit message (Patch Commit). Red Hat tracked the issue via Bugzilla (Bug ID 2456740) and classified it as high severity/priority (Red Hat Bugzilla). No significant broader community discussion or notable researcher commentary beyond standard vulnerability tracking has been observed at this time.