Vulnpedia
← Search CVEs

CVE-2026-104994

LOW 2.5

Published 2026-10-02 · Last modified 2026-10-05

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input (e.g., upon a third-party pull request that contains a Terraform configuration), if sensitive data can be found at those unintended pathnames, and an adversary can then view a sensitive data value within scan output.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 9th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

2.5CVSS 3.1 · LOW

  • ConfidentialityLow
  • IntegrityNone
  • AvailabilityNone

What an attacker needs

  • ⚠Access: Requires local access to the host
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Aquasec

Products Trivy

Weakness (CWE)

  • CWE-24: Path Traversal: '../filedir'

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References and research data (JSON)

Vendor product assessments

  • trivy-0:0.74.0-0.4.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Run Trivy in an ephemeral, unprivileged container or sandbox when scanning untrusted Terraform configurations. Avoid mounting sensitive host paths or exposing credentials via environment variables in the scanner's execution environment. Alternatively, inspect third-party pull requests before running misconfiguration scans against them.
    Red Hat · CVE-2026-104994 · Updated 2026-10-09T04:23:12+00:00
  • trivy-0:0.74.0-0.4.hum1@src as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Run Trivy in an ephemeral, unprivileged container or sandbox when scanning untrusted Terraform configurations. Avoid mounting sensitive host paths or exposing credentials via environment variables in the scanner's execution environment. Alternatively, inspect third-party pull requests before running misconfiguration scans against them.
    Red Hat · CVE-2026-104994 · Updated 2026-10-09T04:23:12+00:00
  • trivy-0:0.74.0-0.4.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Run Trivy in an ephemeral, unprivileged container or sandbox when scanning untrusted Terraform configurations. Avoid mounting sensitive host paths or exposing credentials via environment variables in the scanner's execution environment. Alternatively, inspect third-party pull requests before running misconfiguration scans against them.
    Red Hat · CVE-2026-104994 · Updated 2026-10-09T04:23:12+00:00

All CVSS metrics

  • LOW 2.5 v3.1 · CNA Primary
    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
  • LOW 2.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS