CVE-2026-63328: 
Trivy vulnerability analysis and mitigation

CVE-2026-63328 is a path traversal vulnerability in the Trivy security scanner's plugin manager that allows arbitrary file writes outside the intended plugin directory. The flaw exists in pkg/plugin/manager.go, which uses plugin manifest metadata to construct filesystem paths under ~/.trivy/plugins without properly confining plugin names to that root directory. All versions of Trivy prior to 0.72.0 (Go package github.com/aquasecurity/trivy) are affected; plugins distributed through the official Trivy plugin index are not impacted. It carries a CVSS v4 base score of 6.8 (Medium) (GitHub Advisory, Aqua Security Advisory). The vulnerability was originally published on June 30, 2026, and added to the GitHub Advisory Database on August 18, 2026.

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal): pkg/plugin/manager.go directly joins attacker-controlled plugin name values from the plugin manifest onto the plugin root path without sanitizing path traversal sequences (e.g., ../), allowing the resulting path to escape ~/.trivy/plugins (GitHub Advisory). Exploitation requires a user to install or run a malicious plugin via trivy plugin install or trivy plugin run — the attacker must craft a plugin manifest with a traversal-containing name field and distribute it to the victim. The fix (commit d4213d7) adopts Go's os.Root API to confine all plugin file operations within the plugin root directory, preventing path escape (Trivy Commit).

A successful exploit allows an attacker-controlled plugin to write the plugin manifest and downloaded binary to any filesystem path writable by the user running Trivy, effectively enabling arbitrary file write with the victim user's privileges. This can lead to code execution — for example, by overwriting shell initialization files, cron jobs, SSH authorized keys, or other user-writable executables — though no privilege escalation beyond the current user's permissions is possible. Integrity and availability of the affected system are rated High in the CVSS v4 assessment, while confidentiality impact is None (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the social engineering prerequisite. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires active user interaction — specifically, a user must be tricked into installing a malicious plugin from an untrusted source (Aqua Security Advisory).

1. Craft a malicious plugin manifest: Create a plugin.yaml manifest file with a plugin name field containing path traversal sequences (e.g., ../../.ssh/authorized_keys or ../../.bashrc) to target a writable file outside ~/.trivy/plugins.
2. Package the malicious plugin: Bundle the crafted manifest with a plugin binary (which can itself be a malicious executable) into a distributable plugin archive or repository.
3. Distribute the plugin: Publish the malicious plugin to a public repository, paste the install command into documentation, forums, or issue trackers, or otherwise socially engineer the target user into running trivy plugin install <malicious-source> or trivy plugin run <malicious-source>.
4. Trigger file write: When the victim runs the install or run command on a vulnerable Trivy version (< 0.72.0), the plugin manager constructs the destination path using the unsanitized plugin name, writing the manifest and binary to the attacker-specified location outside the plugin root.
5. Achieve code execution: If the written file is a shell init script, cron job, or other auto-executed file, the attacker's payload executes with the victim user's privileges on the next trigger event (Aqua Security Advisory, Trivy Commit).

• File System: Unexpected files written outside ~/.trivy/plugins/, particularly in home directory subdirectories such as ~/.ssh/, ~/.bashrc, ~/.profile, or cron directories; plugin manifest (plugin.yaml) or binary files appearing in unexpected locations.
• File System: Plugin directories under ~/.trivy/plugins/ with names containing .., /, or other path traversal characters.
• Logs: Shell history or audit logs showing execution of trivy plugin install or trivy plugin run with an external or unfamiliar plugin source URL.
• Process: Unexpected processes spawned by Trivy or from files recently written to user home directories (e.g., modified .bashrc executing on next login).
• Network: Outbound connections from the Trivy process to unfamiliar plugin distribution URLs during plugin install or run operations.

Upgrade Trivy to version 0.72.0 or later, which fixes the vulnerability by using Go's os.Root API to confine all plugin file operations within the plugin root directory (Trivy v0.72.0 Release, Trivy Commit). As a workaround for users who cannot immediately upgrade, only install plugins from the official Trivy plugin index, which is not affected by this vulnerability. Avoid running trivy plugin install or trivy plugin run with plugin sources from untrusted or unverified third parties, and review plugin manifest files before installation (Aqua Security Advisory).

The vulnerability was reported by security researcher @fatihhcelik and acknowledged by the Aqua Security team (maintainer knqyf263), who published the advisory and fix on June 30, 2026 (Aqua Security Advisory). The advisory notes that the trust boundary for Trivy plugins was already documented — users are advised to only install trusted plugins — and that this issue does not fundamentally change that model. No significant broader media coverage or notable social media discussion has been identified beyond the official advisory.