CVE-2026-104994

LowCVSS 2.5/10Last modified Oct 5, 2026

Description

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input (e.g., upon a third-party pull request that contains a Terraform configuration), if sensitive data can be found at those unintended pathnames, and an adversary can then view a sensitive data value within scan output.

Metrics

CVSS 3.1 2.5/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-24

Affected software

No affected versions have been published.

Timeline

Published
Oct 2, 2026
Last modified
Oct 5, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1049958.1The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_templatCVE-2026-10507.3A flaw has been found in risesoft-y9 Digital-Infrastructure up to 9.6.7. This affects an unknown function of the file source-code/src/main/jCVE-2026-1050037.8Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.CVE-2026-1050047.8Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.CVE-2026-1050058.1Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network.CVE-2026-1050066.4Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-1050078.8An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length CVE-2026-1050089.0No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.CVE-2026-1050097.5Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.CVE-2026-1050109.8Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.CVE-2026-1050137.4Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-1050149.1Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to ex
CVE-2026-104994: Low severity, CVSS 2.5 | Vulnix