# F-TUF-008 — addendum (delta-only)

this file contains only data not present in the bundled archive (TRIAGE.md, BUNDLE.JSON, Makefile).

## pins

see the bundled archive → TRIAGE.md or BUNDLE.JSON for full pins.
- as_of_utc: 2026-01-25T22:59:57Z

## prerequisites (severity-driving)

- attacker can supply or influence a TAP 4 multirepo map file (repoName keys in .repositories)
- local caching enabled (DisableLocalCache=false)





## GHSA sidebar



| field | value |
|-------|-------|
| package | go-tuf |
| ecosystem | Go |
| affected versions | <= 2.4.0 |
| patched versions | none |
| severity | HIGH (8.1) |
| CVSS vector | `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| CWE | CWE-22 |

## impact

path traversal in multirepo initialization can write root.json outside the configured LocalMetadataDir cache base (within process filesystem permissions) when the TAP 4 map file is attacker-controlled.

- affected: applications that fetch or accept TAP 4 map files from untrusted sources; deployments where LocalMetadataDir points to a writable path and repoName is not validated

- not affected: deployments where the map file is always local and trusted; applications that validate repo names as identifiers (reject absolute/separators/traversal); deployments with DisableLocalCache=true

## workarounds

- treat TAP 4 map files as trusted configuration only
- validate repo names before calling multirepo.New()
- set DisableLocalCache=true if disk caching is not required

## patches

fix.patch included.

## flag conditions

n/a

## version branches

n/a

## gotchas

n/a

## regression checklist

- [ ] verify vulnerable behavior on pinned commit
- [ ] verify fixed behavior after applying patch (if present)

## compatibility note

none

## claim ceiling

claim ceiling: evidence supports HIGH at most.

## hashes

```
poc.zip       2d1f282b04eb7fafa4f3f87445519f19e41b1df1602ef3f18ed2333ea0119ce5
e2e.zip       464180ffb5329c35523b475795a872e39c40e82b2df52befaf8e5d646945b014
```

verify: `shasum -a 256 poc.zip`

## thread

- kind: github_security_advisory
- URL: https://github.com/theupdateframework/go-tuf/security/advisories/new