CVE-2026-55092 is a path traversal vulnerability in aquasecurity's Trivy scanner before version 0.71.1. When Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without proper validation. This allows an attacker who can supply a malicious artifact to craft the annotation so that the file is written outside the intended directory, leading to arbitrary file write on the host system. The vulnerability is addressed in Trivy 0.71.1.

An attacker able to make Trivy fetch a malicious OCI artifact can cause Trivy to write files to arbitrary locations on the host filesystem by exploiting the unvalidated filename annotation. This can lead to overwriting critical files, potentially resulting in system compromise or denial of service. The CVSS 4.0 score is 7.0 (high severity), indicating significant impact with no privileges required and user interaction needed.

Upgrade Trivy to version 0.71.1 or later, where this path traversal vulnerability is fixed. No other mitigation is indicated. Patch status is not explicitly stated in the vendor advisory, but the description confirms the fix in 0.71.1.