CVE-2026-40024

OVERVIEW CVE-2026-40024 is a path traversal vulnerability in The Sleuth Kit through version 4.14.0, specifically affecting the tsk_recover utility. The vulnerability enables attackers to write files to arbitrary locations outside the intended recovery directory by exploiting path traversal sequences (/../) embedded in crafted filesystem image filenames or directory paths. SEVERITY This vulnerability carries a CVSS v3.1 score of 7.1 (HIGH) with a local attack vector requiring user interaction but no elevated privileges. The impact is significant, permitting both confidentiality and integrity compromise through arbitrary file write capabilities. An attacker could potentially achieve code execution by overwriting shell configuration files or cron entries, though availability is not directly affected. The FAUCET Risk Score of 47.0/100 indicates moderate overall risk. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability does not appear on CISA's Known Exploited Vulnerabilities (KEV) catalog and is classified as inactive on vulnerability hotlists. The EPSS score of 0.0004 suggests minimal probability of exploitation in the near term. However, the relative simplicity of the attack vector and the potential for post-exploitation persistence through file overwrites warrants monitoring for future proof-of-concept release or weaponization.