CVE-2026-6968: amazon tough Path Traversal

Vulnerability summary

CVE-2026-6968 is a high (CVSS 7.1) Path Traversal vulnerability in amazon tough. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 49.8% of scored vulnerabilities.

Timeline

1. 24-04-2026
   PublishedVulnerability first disclosed.
2. 24-04-2026
   Last modifiedVulnerability information updated.

Description

Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copy_target/link_target, symlinked parent directories in save_target, or symlinked metadata filenames in SignedRole::write, because write paths trust the joined destination path without post-resolution containment verification. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.