Trivy, a popular open‑source scanner, builds plugin installation paths from manifest metadata without constraining the names to the ~/.trivy/plugins directory. This oversight allows a crafted plugin manifest to write files to any user‑writable location, which an attacker can use to overwrite existing executables or configuration files. The flaw exists only for plugins installed by the user and is not present in the official Trivy plugin index. The core weakness is a path traversal (CWE‑22) that can lead to remote code execution if the attacker writes a malicious binary into a location that later executes as part of the system.

The vulnerability affects all releases of Trivy preceding 0.72.0. Any user who runs Trivy with the ability to install third‑party plugins is at risk. The issue does not appear in the official Trivy plugin index, so only external or custom plugin sources could exploit it.

The CVSS score of 6.8 indicates a medium‑to‑high severity. EPSS is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation. The attack requires the user to install or run a malicious plugin, which is an indirect vector and may be mitigated by restricting plugin installation or verifying the source. Nonetheless, because the flaw permits arbitrary file writes on a compromised host, the potential impact is substantial, and timely remediation is recommended.