CVE-2026-104994 Path traversal in Trivy
Attackers can read sensitive files outside the scan root via directory traversal in Terraform scanning, affecting developers using Trivy on untrusted inputs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-104994?
CVE-2026-104994 is a low-severity path traversal vulnerability in aquasec Trivy, published on 2 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input (e.g., upon a third-party pull request that contains a Terraform configuration), if sensitive data can be found at those unintended pathnames, and an adversary can then view a sensitive data value within scan output.
Weakness: CWE-24
Which versions are affected by CVE-2026-104994?
How do I fix CVE-2026-104994?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-104994 being exploited?
There is no known exploitation of CVE-2026-104994 in the wild and no public exploit code.
Sources
Also known as GHSA-87hp-4m93-274g, GHSA-fr63-55g9-p68v.