CVE-2026-24686

CVE-2026-24686 is a path traversal vulnerability affecting go-tuf versions 2.0.0 through 2.4.0, a Go implementation of The Update Framework (TUF). An attacker can manipulate the repository name in an untrusted map file to cause go-tuf to write metadata files outside the intended cache directory. This medium severity vulnerability (CVSS 4.7) requires local access and high attack complexity, potentially leading to unauthorized file creation or modification within the running process's permissions. There is no evidence of active exploitation, no public exploit code, and minimal community discussion or media coverage beyond a single vendor security update.