Path traversal vulnerability in Trivy via crafted OCI artifacts

The GitHub Security Advisory database has disclosed a high-severity vulnerability in aquasecurity/trivy, published on August 25, 2026. The issue arises when Trivy downloads an OCI artifact and uses the `org.opencontainers.image.title` annotation from the artifact manifest as the destination filename without validation. This allows an attacker to craft an annotation that resolves to a path outside the intended destination, enabling Trivy to write layer content to arbitrary locations on the host filesystem.

The vulnerability affects configurations where Trivy is directed to download attacker-controlled OCI artifacts. This can occur through inputs such as the `--db-repository` flag, `TRIVY_DB_REPOSITORY` environment variable, or equivalent settings in `trivy.yaml`. Similar risks apply to Java vulnerability databases, misconfiguration checks bundles, and WASM module installations when overridden to fetch artifacts from non-default repositories. The default configuration, which uses Aqua-operated repositories, is not impacted.

Operators should carefully review any overrides to Trivy's artifact sources before upgrading or deploying. Specifically, ensure that no untrusted or third-party mirrors are being used in the configuration. If overrides are necessary, validate the integrity and trustworthiness of the alternative repositories to mitigate the risk of path traversal attacks. This vulnerability highlights the importance of scrutinizing artifact sources, especially in scenarios where configuration changes deviate from default settings.