Directory Traversal Vulnerability in Terraform Filesystem Functions by Aqua Security

CVE-2026-104994

What is CVE-2026-104994?

Aqua Security's Trivy, prior to version 0.71.0, has a directory traversal vulnerability in its handling of Terraform filesystem functions. This issue arises when scans are conducted on untrusted input, particularly in instances where third-party configurations are involved. If sensitive information is present at unintended path locations, an attacker may access this data through the scan output. Such a vulnerability underscores the importance of thorough security practices when utilizing automation tools like Terraform.

References