CVE-2021-41131: Path Traversal Vulnerability in tuf Package
Summary
CVE-2021-41131: Client metadata path-traversal. Affects tuf versions < 0.19.0. Fixed in 0.19.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tuf package is an open-source software updater for secure distribution of files. It provides a framework for verifying the integrity and authenticity of files using cryptographic signatures. The package is widely used in various applications to ensure secure software updates. However, a path traversal vulnerability has been discovered in the tuf package, which allows an attacker to overwrite files ending in .json on the client system. This vulnerability can be exploited by manipulating the rolename parameter and inserting malicious metadata. The impact of this vulnerability is mitigated by certain factors, but it still poses a significant risk to systems that allow arbitrary rolename selection for delegated targets metadata.
Vulnerability Detail
The path traversal vulnerability in the tuf package allows an attacker to traverse the file system and overwrite files ending in .json. This vulnerability arises when the rolename parameter is used to form the filename, and it can contain path traversal characters. By inserting new metadata for a path-traversing role and getting the role delegated by existing targets metadata, an attacker can overwrite arbitrary files on the client system. However, the written file content is restricted to valid, signed targets files with the .json extension. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: 7.0.1 as of 23 Oct 2026
pip install --upgrade "tuf==7.0.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.19.0
This is the first release that contains the fix.
pip install --upgrade "tuf==0.19.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no effective workarounds for this vulnerability that do not require code changes. However, clients can implement certain measures to mitigate the risk. One approach is to restrict the allowed character set for rolenames, ensuring that they cannot contain path traversal characters. Another option is to store metadata in files named in a way that is not vulnerable to path traversal. However, both of these approaches require modifications to the python-tuf code.
Conclusion
The path traversal vulnerability in the tuf package poses a significant risk to systems that allow arbitrary rolename selection for delegated targets metadata. It allows an attacker to overwrite files ending in .json on the client system by manipulating the rolename parameter. To mitigate this vulnerability, it is crucial to update the tuf package to version 0.19 or newer. Additionally, implementing measures like restricting character sets for rolenames can further reduce the risk. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tuf →
FAQ
The tuf package is an open-source software updater for secure distribution of files. It provides a framework for verifying the integrity and authenticity of files using cryptographic signatures.
The path traversal vulnerability in tuf allows an attacker to overwrite files ending in .json on the client system. However, the impact is mitigated by certain factors, such as the need for the attacker to insert new metadata and get the role delegated by existing targets metadata. Additionally, the written file content is restricted to valid, signed targets files with the .json extension.
To fix the vulnerability, update the tuf package to version 0.19 or newer. This update includes a fix for the path traversal issue and ensures proper sanitization of the rolename parameter.
There are no effective workarounds for this vulnerability that do not require code changes. However, clients can implement measures like restricting the character set for rolenames or storing metadata in files named in a way that is not vulnerable to path traversal.
For more information, you can refer to the official advisory in the python-tuf repository or contact the maintainers via email or Slack.
References
Related vulnerabilities
Recent vulnerabilities recorded for tuf.
