Directory traversal in Terraform filesystem functions can expose files through aquasec Trivy

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input (e.g., upon a third-party pull request that contains a Terraform configuration), if sensitive data can be found at those unintended pathnames, and an adversary can then view a sensitive data value within scan output.

aquasec Trivy:

• The affected component is Terraform configuration parsing and Terraform filesystem functions used during misconfiguration scanning.
• The record lists semver range 0 < 0.71.0 as affected.
• The recorded default_status is unaffected, but the explicit affected version entry identifies the range above as affected.
• The vendor changelog records the fix in release 0.71.0.
• No additional parallel branch or release boundary was confirmed in the reviewed evidence.

aquasec Trivy's Terraform parser passes a filesystem object to Terraform filesystem functions. In the vulnerable behavior, a mapfs.FS configured with WithUnderlyingRoot could fall back to the host filesystem, allowing ../ path components to read files above the scan root. The affected functions include file(), filebase64(), and related file-reading functions. Exploitation requires an attacker to supply or influence Terraform configuration processed by a scan, a sensitive file at an unintended pathname, and access to the resulting scan output. The supplied attack characteristics describe local reachability, low privileges, high complexity, no user interaction, and unchanged scope. The record does not establish the complete set of deployment-specific pathnames or the exact output channel.

The described attack path is local rather than direct exposure of a remotely reachable network service. The attacker has low required privileges, the attack complexity is high, and no user interaction is required after untrusted input reaches the scan. The practical preconditions are that misconfiguration scanning processes untrusted Terraform configuration, sensitive data exists outside the scan root, and the adversary can view scan output. The normalized record marks public_exploit as false. It provides no confirmed detail about exploitation in the wild or a ransomware campaign, so current abuse status is not established.

Successful exploitation can disclose values from files outside the scan's intended trust boundary. This is a conditional confidentiality disclosure, not a mechanism the record describes for modifying files or disrupting service. The attacker must get untrusted Terraform input processed and must be able to view the scan output, so every Trivy deployment is not automatically exposed in the same way. The supplied attack characteristics indicate unchanged scope, with no recorded integrity or availability impact. Organisational consequences depend on what sensitive data is present at unintended pathnames and how scan output is retained or shared.

The primary consequence is conditional disclosure of sensitive data from files outside the intended scan-root boundary. An attacker who controls untrusted Terraform input may cause scan output to disclose values that Trivy can read from unintended pathnames. The practical risk depends on whether sensitive files exist outside the scan root and whether the adversary can view the scan output. Exposure is concentrated in automated workflows that process third-party pull requests or other untrusted Terraform sources. The record does not describe an integrity or availability effect.

1. Upgrade aquasec Trivy to the confirmed fixed release 0.71.0. Do not infer the status of later or parallel branches from this entry alone.
2. If an upgrade cannot be applied immediately, use the vendor-documented workaround of scanning from the repository root so referenced files remain within the scan boundary. Example:

trivy config --skip-dirs envs/staging ./

1. As a temporary risk reduction, consider preventing scan output from untrusted Terraform scans from being exposed to third parties while a vulnerable build remains in use. This does not replace upgrading.
2. After remediation, run regression tests to confirm that Terraform filesystem functions cannot access pathnames above the scan root while files inside the scan root continue to work.

1. Inventory aquasec Trivy installations in developer workstations, CI runners, container images, and automation, then identify deployments within the affected range.
2. Identify jobs that run misconf or Terraform scans on third-party pull requests or other untrusted Terraform sources.
3. Review Terraform configurations that use file(), filebase64(), or related file-reading functions with pathnames that can resolve above the scan root through parent-directory components.
4. Review where scan output is stored or displayed, and look for sensitive values that could have been read from outside the scan root. The absence of such values in available output does not prove that the system is safe.
5. In regression testing, confirm that files inside the scan root remain readable while requests such as ../secret.txt are rejected and existence checks for paths outside the root return false.
6. No specific IOC is provided for this flaw. Generic monitoring is a precaution, not a known indicator.