Trivy before version 0.71.0 has a directory‑traversal flaw in its Terraform filesystem functions. When a scan attempts to resolve pathnames that ascend above the scan root, the function may access files outside the intended directory. An attacker scanning a malicious or untrusted Terraform configuration (for example, a third‑party pull request) could exploit this to read any data that resides at those unintended pathnames. The flaw is a CWE‑22 Path Traversal issue (also noted as CWE‑24), and the primary impact is a breach of confidentiality: the attacker gains viewable information that should have been locked behind the scan root.

The vulnerability affects Aquasec Trivy, a popular open‑source vulnerability scanner. All releases prior to 0.71.0 are impacted. Users of any Trivy instance that scans Terraform code before this patch are in scope.

The CVSS score of 2.5 signals a low‑severity problem, and the EPSS score of < 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires the scanner to evaluate untrusted input containing Terraform files that reference parent directories. There is no remote network attack vector; the weakness is exercised during local scan jobs (for example, CI pipelines). While the low CVSS indicates limited damage, the secrecy of files read can still be significant in contexts where the scan environment has access to privileged data. Organizations should treat this as a low‑to‑moderate risk in environments that automatically process third‑party code, but the risk diminishes in strictly controlled, trusted scanning processes.