Trivy versions prior to 0.71.0 contain a path traversal vulnerability (CWE-24) in their Terraform filesystem functions. When performing misconfiguration scanning on untrusted input, the functions may access pathnames above the designated scan root directory. This can allow an attacker to cause Trivy to read sensitive files outside the intended scope, potentially exposing confidential information in the scan results. The vulnerability is exploitable locally with low privileges and requires high attack complexity, resulting in limited confidentiality impact and no integrity or availability impact. The CVSS 3.1 base score is 2.5 (low).

The vulnerability allows limited unauthorized disclosure of sensitive data if an attacker can supply untrusted Terraform configurations for scanning. The attacker must have local access with low privileges and the ability to trigger misconfiguration scanning on crafted input. The impact is limited to confidentiality with no integrity or availability effects. There are no known exploits in the wild.

A fix is available in Trivy version 0.71.0 and later. Users should upgrade to version 0.71.0 or newer to remediate this vulnerability. Until upgrading, avoid scanning untrusted Terraform configurations or restrict scanning to trusted inputs only. No vendor advisory content was provided, so check the official aquasec Trivy release notes for confirmation and additional guidance.