CVE-2026-104994
LowCVSS 2.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input (e.g., upon a third-party pull request that contains a Terraform configuration), if sensitive data can be found at those unintended pathnames.
Risk Assessment
An attacker can cause Trivy to read and expose sensitive data located outside the scanned directory in the scan output. This may lead to leakage of secrets, keys, or other confidential information from the filesystem.
Recommendation
Upgrade Trivy to version 0.71.0 or later. Until then, avoid running misconf scanning on untrusted Terraform configurations, especially those from external pull requests.
Other vulnerabilities in Trivy
Original NVD description (English source)
Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input (e.g., upon a third-party pull request that contains a Terraform configuration), if sensitive data can be found at those unintended pathnames, and an adversary can then view a sensitive data value within scan output.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS