---
id: CVE-2021-41087
aliases:
  - GHSA-vrxp-mg9f-hwf3
  - GO-2022-0936
title: Improperly Implemented path matching for in-toto-golang
summary: Improperly Implemented path matching for in-toto-golang
severity: medium
cvss: 5.6
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N'
vendor: in-toto
product: github.com/in-toto/in-toto-golang
ecosystem: go
affected:
  - github.com/in-toto/in-toto-golang < 0.3.0
patched:
  - github.com/in-toto/in-toto-golang 0.3.0
published: '2021-09-22'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vrxp-mg9f-hwf3'
references:
  - url: >-
      https://github.com/in-toto/in-toto-golang/security/advisories/GHSA-vrxp-mg9f-hwf3
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-41087'
  - url: >-
      https://github.com/in-toto/in-toto-golang/commit/f2c57d1e0f15e3ffbeac531829c696b72ecc4290
  - url: 'https://github.com/in-toto/in-toto-golang'
tags:
  - osv
  - go
epss: 0.0043
epssPercentile: 0.34591
ingestedAt: '2026-07-09T18:56:36.941Z'
---

## Overview

### Impact
Authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo).

### Patches
The problem has been fixed in version 0.3.0.

### Workarounds
Exploiting this vulnerability is dependent on the specific policy applied.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [in-toto-golang](http://github.com/in-toto/in-toto-golang)
* Email us at [in-toto-public](mailto:in-toto-public@googlegroups.com)
* If this is a sensitive security-relevant disclosure, please send a PGP encrypted email to santiagotorres@purdue.edu or jcappos@nyu.edu


## Affected packages

- `github.com/in-toto/in-toto-golang < 0.3.0`

## Remediation

Upgrade to a patched release:

- `github.com/in-toto/in-toto-golang 0.3.0`