Note: This data is for reference and cybersecurity research purposes only.CyStack advises users not to use this information for unlawful purposes.
CVE-2026-63328 is a vulnerability classified as Improper Limitation of a Pathname to a Restricted Directory, affecting trivy (affected versions: < 0.72.0). This vulnerability is rated Medium, with a CVSS score of 6.8. Current sources do not report this vulnerability as exploited.
A short verification protects the vulnerability source and prevents automated AI abuse.
Verifying...
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
en
