CVE-2026-104994 in Trivy
Summary
by MITRE • 10/02/2026
Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input (e.g., upon a third-party pull request that contains a Terraform configuration), if sensitive data can be found at those unintended pathnames, and an adversary can then view a sensitive data value within scan output.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in Trivy versions prior to 0.71.0 represents a critical directory traversal flaw specifically affecting the handling of Terraform filesystem functions during misconfiguration scanning operations. This security issue arises from insufficient validation of pathnames provided by Terraform configuration files, allowing an attacker to manipulate file access requests to traverse outside the designated scan root directory. In normal operation, static analysis tools like Trivy are designed to inspect code within a specific context or repository structure without exposing the underlying host filesystem. However, when processing Terraform configurations that utilize functions such as local_file or similar mechanisms for reading external data, the tool failed to strictly enforce boundary constraints on the resolved file paths. This lack of sanitization permits path traversal sequences, typically represented by dot-dot-slash characters, which bypass the intended sandboxing and allow access to arbitrary locations on the host system where Trivy is executed.
The operational impact of this vulnerability is significant in environments that process untrusted Terraform configurations, such as those submitted via third-party pull requests or external contributions. When an adversary injects a maliciously crafted Terraform file containing path traversal sequences into these filesystem functions, they can force the scanning engine to read sensitive files located outside the project directory. If the execution environment contains secrets, credentials, private keys, or other confidential data in accessible directories above the scan root, this information can be exfiltrated through the scan output logs or error messages generated by Trivy. This scenario is particularly dangerous because it turns a standard code quality and security scanning tool into an unintended vector for local file read attacks, potentially leading to full system compromise if combined with other vulnerabilities in the CI/CD pipeline infrastructure.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within file paths that can cause them to resolve to unintended locations. Furthermore, it maps to the MITRE ATT&CK technique T1083: File and Directory Discovery, as the attacker leverages the application's functionality to enumerate and access sensitive files on the local system. The exploitation relies on the principle of insecure direct object references combined with path traversal, exploiting the trust placed in input data processed by security scanning utilities that are often run with elevated privileges or broad filesystem access within automated pipelines.
To mitigate this risk, organizations must immediately upgrade Trivy to version 0.71.0 or later, where these directory traversal issues have been addressed through stricter pathname validation and sandboxing improvements for Terraform-specific functions. In the interim, teams should implement strict input sanitization policies that reject any configuration files containing path traversal sequences before they are processed by scanning tools. Additionally, running Trivy in isolated containers with restricted filesystem permissions can limit the blast radius of such an attack, ensuring that even if a traversal attempt succeeds, it cannot access sensitive host data. Security teams should also audit their CI/CD pipelines to ensure that untrusted inputs from pull requests are not directly fed into static analysis tools without prior validation or sandboxing measures in place.