CVE-2026-104994

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input e.g., upon a third-party pull request that contains a Terraform configuration, if sensitive data c...

CVE-2026-104994

Versions of Trivy prior to 0.71.0 are vulnerable to a directory traversal issue within Terraform filesystem functions . The root cause occurs when these functions attempt to access pathnames located above the designated scan root. This risk is particularly relevant when performing misconf scannin...

CVE-2026-104994

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input e.g., upon a third-party pull request that contains a Terraform configuration, if sensitive data c...

PT-2026-104433

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input e.g., upon a third-party pull request that contains a Terraform configuration, if sensitive data c...

github.com/aquasecurity/trivy: Trivy: Information disclosure via directory traversal in Terraform filesystem functions

A flaw was found in Trivy. This vulnerability allows information disclosure when scanning untrusted Terraform configuration files for misconfigurations. An attacker can craft a configuration that uses filesystem functions to reference pathnames outside the designated scan root directory. This...

CVE-2023-39332

Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings see CVE-2023-30584 and Buffer objects see CVE-2023-32004, but not through non-Buffer...

CVE-2015-5070

The 1 filesystem::getwmllocation function in filesystem.cpp and 2 islegalfile function in filesystemboost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to...

CVE-2015-5070

The 1 filesystem::getwmllocation function in filesystem.cpp and 2 islegalfile function in filesystemboost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to...

TikiWiki unserialize() Function Arbitrary Code Execution

The version of the TikiWiki installed on the remote host contains a flaw that could allow a remote attacker to execute arbitrary code. The 'unserialize' function is not properly sanitized before being used in the 'lib/banners/bannerlib.php', 'tiki-printmultipages.php', 'tiki-sendobjects.php' and...