What’s Vulnerable › Vulnerabilities

CVE-2026-40024: Sleuth Kit tsk_recover Path Traversal

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-08 · updated 2026-07-25
• Weakness: CWE-22

Description

The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path traversal sequences in a filesystem image. An attacker can craft a malicious filesystem image with embedded /../ sequences in filenames that, when processed by tsk_recover, writes files outside the output directory, potentially achieving code execution by overwriting shell configuration or cron entries.

Affected products

• sleuthkit: before 4.15.0 — fixed in 4.15.0

How to fix

Upgrade to a fixed version: sleuthkit 4.15.0. Check the vendor advisory for mitigations.

References

• https://github.com/sleuthkit/sleuthkit/commit/a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b
• https://mobasi.ai/sentinel
• https://www.vulncheck.com/advisories/sleuth-kit-tsk-recover-path-traversal

Get alerted when CVE-2026-40024 or the next vulnerability affects your stack