CVE-2026-6968

Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copytarget/linktarget, symlinked parent directories in savetarget, or symlinked...

PT-2026-35081

Name of the Vulnerable Software and Affected Versions awslabs/tough versions prior to 0.22.0 Description Incomplete path traversal fixes allow remote authenticated users with delegated signing authority to write files outside intended output directories. This occurs because write paths trust the...

tough-kms (>=0.2.0 <=0.3.3), tough-ssm (>=0.5.0 <=0.6.3) +1 more potentially affected by CVE-2021-41149 via tough (>=0.10.0 <=0.11.3)

tough CARGO version =0.10.0, =0.2.0, =0.5.0, =0.6.0, =0.6.4 Source cves: CVE-2021-41149 Source advisory: OSV:GHSA-X3R5-Q6MJ-M485...