CyberRota Analysis
AI-GeneratedTrivy versions prior to 0.71.0 are vulnerable to directory traversal attacks in Terraform filesystem functions, allowing access to pathnames above the designated scan root. This vulnerability can lead to the exposure of sensitive data when scanning untrusted input, such as third-party Terraform configurations. Organizations utilizing Trivy for security scanning, particularly those handling untrusted code, should prioritize updating to mitigate potential data leaks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input (e.g., upon a third-party pull request that contains a Terraform configuration), if sensitive data can be found at those unintended pathnames, and an adversary can then view a sensitive data value within scan output.