Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-40024 is a high-severity Path Traversal (CWE-22) vulnerability in Sleuthkit The Sleuth Kit. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The Sleuth Kit through version 4.14.0 is affected by CVE-2026-40024, a path traversal vulnerability (CWE-22) in the tsk_recover component. This flaw allows an attacker to write files to arbitrary locations outside the intended recovery directory by supplying a crafted filesystem image containing filenames or directory paths with path traversal sequences, such as /../ embedded in entries. When tsk_recover processes the image, it fails to properly sanitize these sequences, enabling unintended file writes.
Exploitation requires local access (AV:L) with low complexity (AC:L), no privileges (PR:N), and user interaction (UI:R), as scored at CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). A local attacker can craft a malicious filesystem image and trick a user—such as a forensic analyst—into running tsk_recover on it with a specified output directory. Successful exploitation allows writing files outside that directory, potentially overwriting critical files like shell configurations or cron entries to achieve code execution, with high impacts on confidentiality and integrity but no availability disruption.
Mitigation is addressed in a Sleuth Kit GitHub commit (a3f96b3bc36a8bb1a00c297f77110d4a6e7dd31b), which patches the path traversal issue. Additional details are available in advisories from VulnCheck (vulncheck.com/advisories/sleuth-kit-tsk-recover-path-traversal) and Mobasi (mobasi.ai/sentinel). Security practitioners should update to a patched version of The Sleuth Kit and avoid processing untrusted filesystem images with tsk_recover.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20759
Vulnerability Data
The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path traversal sequences in a filesystem…
more
image. An attacker can craft a malicious filesystem image with embedded /../ sequences in filenames that, when processed by tsk_recover, writes files outside the output directory, potentially achieving code execution by overwriting shell configuration or cron entries.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2
Mitigating Controls (NIST 800-53 r5) AI
Enforces the intended directory access authorizations that path traversal would otherwise bypass.
Input validation directly neutralizes special path elements before pathname construction occurs.
Least privilege reduces the impact of any unauthorized file access obtained via traversal.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.
Application security requirements include rules for safe file handling and canonicalization.
Secure architecture principles require least-privilege file access and directory isolation.
Secure coding standards explicitly forbid unsafe path construction and mandate safe APIs.
Security testing in development catches path traversal via static/dynamic analysis.
Information access restriction limits which files an application may read or write.