CVE-2026-55092 is a path traversal vulnerability (CWE-22) in aquasecurity's Trivy scanner. Before version 0.71.1, Trivy downloads OCI artifacts and uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without proper validation. An attacker able to supply a malicious artifact can craft this annotation to resolve to a path outside the intended directory, causing arbitrary file writes on the host filesystem. This can lead to unauthorized file modification or overwriting critical files. The issue is resolved in Trivy 0.71.1.

An attacker who can cause Trivy to fetch a malicious OCI artifact can exploit this vulnerability to write files to arbitrary locations on the host filesystem. This can lead to unauthorized file modification, potential privilege escalation, or disruption of system integrity. The vulnerability has a high severity score (CVSS 7.0) indicating significant impact if exploited.

Upgrade Trivy to version 0.71.1 or later, where this path traversal vulnerability is fixed. No other mitigation is indicated or required as the fix addresses the root cause by validating the destination filename.