{"id":"CVE-2026-40024","title":"The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path…","summary":"The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cwe":["CWE-22"],"vendor":"sleuthkit","product":"the_sleuth_kit","affected":["the_sleuth_kit < 4.15.0"],"patched":["the_sleuth_kit 4.15.0"],"published":"2026-04-08","updated":"2026-07-25","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40024","references":[{"url":"https://github.com/sleuthkit/sleuthkit/commit/a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b","label":"disclosure@vulncheck.com"},{"url":"https://mobasi.ai/sentinel","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/sleuth-kit-tsk-recover-path-traversal","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00167,"epssPercentile":0.06325,"ingestedAt":"2026-07-26T10:11:58.619Z","slug":"CVE-2026-40024","body":"## Overview\n\nThe Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path traversal sequences in a filesystem image. An attacker can craft a malicious filesystem image with embedded /../ sequences in filenames that, when processed by tsk_recover, writes files outside the output directory, potentially achieving code execution by overwriting shell configuration or cron entries.\n\n## Affected\n\n- `the_sleuth_kit < 4.15.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `the_sleuth_kit 4.15.0`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}