CVE-2026-24137

A path traversal flaw has been discovered in the sigstore go library. In versions 1.10.3 and below, the legacy TUF client pkg/tuf/client.go supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target...