---
id: CVE-2026-40024
title: >-
  The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in
  tsk_recover that allows an attacker to write files to arbitrary locations
  outside the intended recovery directory via crafted filenames or directory
  paths with path…
summary: >-
  The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in
  tsk_recover that allows an attacker to write files to arbitrary locations
  outside the intended recovery directory via crafted filenames or directory
  paths with path…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'
cwe:
  - CWE-22
vendor: sleuthkit
product: the_sleuth_kit
affected:
  - the_sleuth_kit < 4.15.0
patched:
  - the_sleuth_kit 4.15.0
published: '2026-04-08'
updated: '2026-07-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-40024'
references:
  - url: >-
      https://github.com/sleuthkit/sleuthkit/commit/a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b
    label: disclosure@vulncheck.com
  - url: 'https://mobasi.ai/sentinel'
    label: disclosure@vulncheck.com
  - url: 'https://www.vulncheck.com/advisories/sleuth-kit-tsk-recover-path-traversal'
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00207
epssPercentile: 0.09543
ingestedAt: '2026-07-26T10:11:58.619Z'
---

## Overview

The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path traversal sequences in a filesystem image. An attacker can craft a malicious filesystem image with embedded /../ sequences in filenames that, when processed by tsk_recover, writes files outside the output directory, potentially achieving code execution by overwriting shell configuration or cron entries.

## Affected

- `the_sleuth_kit < 4.15.0`

## Remediation

Upgrade past the affected range:

- `the_sleuth_kit 4.15.0`