CVE details
CVE-2026-40024
The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path traversal sequences in a filesystem image. An attacker can craft a malicious filesystem image with embedded /../ sequences in filenames that, when processed by tsk_recover, writes files outside the output directory, potentially achieving code execution by overwriting shell configuration or cron entries.
Affected ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| sysutils/sleuthkit | sleuthkit | 4.12.1 | unaddressed | antoine@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>sleuthkit</name>
<range><lt>4.15.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Sleuth Kit through 4.14.0 contains a path traversal vulnerability
in tsk_recover that allows an attacker to write files to arbitrary
locations outside the intended recovery directory via crafted
filenames or directory paths with path traversal sequences in a
filesystem image. An attacker can craft a malicious filesystem image
with embedded /../ sequences in filenames that, when processed by
tsk_recover, writes files outside the output directory, potentially
achieving code execution by overwriting shell configuration or cron
entries.</p>
</body>
</description>
<references>
<cvename>CVE-2026-40024</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-40024</url>
</references>
<dates>
<discovery>2026-04-08</discovery>
<entry>2026-10-25</entry>
</dates>
</vuln>