CVE-2026-104994GHSA-87hp-4m93-274g
Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input (
aquasec Trivy
CVSS
2.5LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.71.0TrivyCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input (e.g., upon a third-party pull request that contains a Terraform configuration), if sensitive data can be found at those unintended pathnames, and an adversary can then view a sensitive data value within scan output.
Text from CVE List
Affected versions 1
- Trivyaffected: all versions before 0.71.0CVE List
References 4
- github.com/aquasecurity/trivy/commit/9d91b888cf63023e9c09b64259a4c1cea8dfe993Fixvia CVE List
- github.com/aquasecurity/trivy/blob/main/CHANGELOG.mdFixvia CVE List
- github.com/aquasecurity/trivy/security/advisories/GHSA-87hp-4m93-274gAdvisoryvia CVE List
- github.com/aquasecurity/trivy/pull/10664Advisoryvia CVE List