CVE-2026-6968: tough from 0.9.0 (inclusive), before 0.22.0 (exclusive), 0 to before 0.22.0; +1 more affected products

Affected technology

tough · from 0.9.0 (inclusive), before 0.22.0 (exclusive)
amazon

tuftool · before 0.15.0 (exclusive)
amazon

tough · 0 to before 0.22.0
AWS

tuftool · 0 to before 0.15.0
AWS

Description’s affected range: before tough-v0.22.0

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Remote authenticated users with delegated signing authority can write files outside intended output directories via absolute target names in copy_target/link_target, symlinked parent directories in save_target, or symlinked metadata filenames in SignedRole::write, because write paths trust the joined destination path without post-resolution containment verification. Source advisory’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality and availability impact as none; integrity impact as high.