Sleuth Kit tsk_recover Pfadüberschreitung

The core impact of this path traversal vulnerability lies in its ability to bypass intended file system boundaries. An attacker can craft a malicious filesystem image containing filenames with carefully constructed /../ sequences. When The Sleuth Kit's tsk_recover function processes this image, it will incorrectly interpret these sequences, allowing the attacker to write files to locations outside the designated recovery directory. This could involve overwriting shell configuration files (e.g., .bashrc, .profile), cron entries, or other system binaries, effectively achieving remote code execution. The blast radius extends to any system running The Sleuth Kit and processing potentially malicious filesystem images, particularly in forensic analysis workflows where untrusted images are routinely handled.

Digital forensics investigators and security analysts who utilize The Sleuth Kit for analyzing filesystem images are at risk. Specifically, those using older, unpatched versions of the tool in automated workflows or environments with limited access controls are particularly vulnerable. Shared hosting environments where multiple users have access to filesystem images are also at increased risk.

• linux / server:

journalctl -g "tsk_recover" -u the-sleuth-kit | grep -i "path traversal"

• linux / server:

lsof | grep /path/to/recovery/directory/../

• linux / server:

find / -name '*..*' -print 2>/dev/null

1. 2026-04-08Disclosure

   disclosure

1. Reserviert2026-04-08
2. Veröffentlicht2026-04-08
3. Geändert2026-04-09
4. EPSS aktualisiert2026-04-16

The primary mitigation for CVE-2026-40024 is to upgrade to The Sleuth Kit version 4.15.0 or later, which contains the fix. If upgrading immediately is not feasible due to compatibility concerns or system downtime requirements, consider implementing temporary workarounds. One approach is to sanitize all filesystem image filenames before processing them with tskrecover, removing or escaping any /../ sequences. Additionally, restrict the permissions of the user account running tskrecover to minimize the potential impact of a successful exploit. Monitor system logs for unusual file creation activity in unexpected directories. After upgrading, confirm the fix by attempting to recover a test filesystem image with a known malicious filename containing path traversal sequences; the files should not be written outside the intended recovery directory.