CVE-2026-0312: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Palo Alto Networks Checkov by Prisma Cloud

This vulnerability (CWE-22) in Palo Alto Networks Checkov by Prisma Cloud involves improper limitation of a pathname to a restricted directory, enabling an unauthenticated local attacker to perform path traversal and write files to arbitrary locations on the scanning filesystem. The affected versions are all releases before 3.3.25. The CVSS 4.0 vector indicates local attack vector with low complexity, no privileges required, but user interaction is needed. The impact includes potential modification of files on the filesystem, which could lead to further compromise depending on the environment.

An unauthenticated local user can write files to arbitrary locations on the filesystem used by the Checkov scanner. This could allow modification or creation of files that may affect the integrity or behavior of the system running Checkov. The vulnerability does not require privileges but does require local access and user interaction. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor Palo Alto Networks advisories for an official fix or update. Until a patch is available, restrict local access to systems running affected versions and avoid running Checkov in untrusted environments.