CVE-2026-24686 | theupdateframework go-tuf up to 2.4.0 Cache Directory /escaped-repo path traversal

A vulnerability was found in theupdateframework go-tuf up to 2.4.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /escaped-repo of the component Cache Directory Handler. The manipulation results in path traversal.

This vulnerability is identified as CVE-2026-24686. The attack is only possible with local access. There is not any exploit available.

It is recommended to upgrade the affected component.