Description
Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem.
Published: 2026-10-14
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local File Write
Action: Upgrade
AI Analysis

Impact

Path traversal vulnerabilities in Checkov by Prisma Cloud allow an unauthenticated local user to write arbitrary files to the scanning host’s filesystem. This flaw, identified as CWE-22, can be leveraged to overwrite configuration or sensitive files, potentially compromising the integrity of the Analysis environment or enabling persistence.

Affected Systems

Palo Alto Networks’ Checkov by Prisma Cloud products from version 3.2.0 through 3.3.24 are affected. Versions 3.3.25 and later contain the fix, and the Prisma Cloud integration is upgraded automatically when new versions become available.

Risk and Exploitability

The CVSS score of 4.3 denotes moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation. The attack vector is local; an adversary must have filesystem access on the machine running Checkov and does not require network or privileged credentials. Consequently, the risk is confined to the local host and does not threaten broader network security.

Generated by OpenCVE AI on October 15, 2026 at 13:25 UTC.

Remediation

Vendor Workaround

Until a fixed version is deployed, avoid running Checkov over untrusted content, and pass configuration explicitly via a trusted configuration file rather than allowing configuration to be auto-loaded from the scanned directory.

OpenCVE Recommended Actions

  • Apply the official patch by upgrading Checkov to version 3.3.25 or later.
  • Until the fix is deployed, run Checkov only on trusted content and supply configuration through a dedicated trusted file rather than auto‑loading from the scanned directory.
  • Execute Checkov scans in an isolated or sandboxed environment to contain any local file‑write activity and protect critical host files.

Generated by OpenCVE AI on October 15, 2026 at 13:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem.
Title Checkov by Prisma Cloud: Path Traversal Vulnerabilities
First Time appeared Palo Alto Networks
Palo Alto Networks checkov By Prisma Cloud
Weaknesses CWE-22
CPEs cpe:2.3:a:palo_alto_networks:checkov_by_prisma_cloud:*:*:*:*:*:*:*:*
Vendors & Products Palo Alto Networks
Palo Alto Networks checkov By Prisma Cloud
References
Metrics cvssV4_0

{'score': 4.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber'}

Subscriptions

Palo Alto Networks Checkov By Prisma Cloud
cve-icon MITRE

Status: PUBLISHED

Assigner: palo_alto

Published:

Updated: 2026-10-15T18:40:29.605Z

Reserved: 2025-11-03T20:45:11.196Z

Link: CVE-2026-0312

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-14T21:17:18.013

Modified: 2026-10-14T21:17:18.013

Link: CVE-2026-0312

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-15T13:30:02Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')