github.com/sigstore/sigstore

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

Medium 5.8

CVE-2026-24137

sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal

sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base direc…

sigstore sigstore golang-github-sigstore-sigstore github.com/sigstore/sigstore Debian Ubuntu Go

Jan 23, 2026