A vulnerability was found in sigstore sigstore-go up to 1.10.3. It has been classified as critical. This affects an unknown part of the file pkg/tuf/client.go. This manipulation causes path traversal.
This vulnerability is tracked as CVE-2026-24137. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is recommended.
