Threats tagged 'ghsa-fr63-55g9-p68v'

CVE-2026-104994 is a path traversal vulnerability in aquasec Trivy before version 0.71.0. It allows directory traversal in Terraform filesystem functions during misconfiguration scanning, potentially exposing sensitive data located outside the intended scan root. This risk arises when scanning untrusted input, such as third-party pull requests containing Terraform configurations. The vulnerability has a low CVSS score of 2.5 and requires local access with low privileges and high attack complexity.