/
← Voltar ao feed
medium

Palo Alto Networks discloses CVE-2026-0312 path traversal flaw in Checkov by Prisma Cloud allowing arbitrary file writes

1 fonte(s) · 1 atualização(ões) · publicado 14/10/2026 13:00 · coletado há 10 horas

Palo Alto Networks published advisory CVE-2026-0312 describing path traversal vulnerabilities (CWE-22) in Checkov by Prisma Cloud that let an unauthenticated local user write files to arbitrary locations on the scanning filesystem. No special configuration is required to be exposed. The vendor rates it MEDIUM (CVSS-B 6.8, CVSS-BT 4.3) with moderate suggested urgency and states it is not aware of any malicious exploitation.

Technical Details

  • Affected: Checkov by Prisma Cloud versions from 3.3.0 up to (excluding) 3.3.25.
  • Weakness: CWE-22 Improper Limitation of a Pathname to a Restricted Directory. CVSS 4.0 vector indicates local attack vector, low complexity, no privileges, passive user interaction required, and high integrity impact.
  • The workaround guidance implies exposure arises when scanning untrusted content and when configuration is auto-loaded from the scanned directory.

Remediation

  • Upgrade Checkov to version 3.3.25 or later.
  • Until patched, avoid running Checkov over untrusted content.
  • Pass configuration explicitly through a trusted configuration file instead of allowing auto-loading from the scanned directory.

Linha do tempo

  1. security.paloaltonetworks.com ↗ · pub. 14/10/2026 13:00 · coletado 20/10 16:32 primeiro registro

    Palo Alto Networks discloses CVE-2026-0312 path traversal flaw in Checkov by Prisma Cloud allowing arbitrary file writes

    ler a análise desta fonte

    Palo Alto Networks published advisory CVE-2026-0312 describing path traversal vulnerabilities (CWE-22) in Checkov by Prisma Cloud that let an unauthenticated local user write files to arbitrary locations on the scanning filesystem. No special configuration is required to be exposed. The vendor rates it MEDIUM (CVSS-B 6.8, CVSS-BT 4.3) with moderate suggested urgency and states it is not aware of any malicious exploitation.

    Technical Details

    • Affected: Checkov by Prisma Cloud versions from 3.3.0 up to (excluding) 3.3.25.
    • Weakness: CWE-22 Improper Limitation of a Pathname to a Restricted Directory. CVSS 4.0 vector indicates local attack vector, low complexity, no privileges, passive user interaction required, and high integrity impact.
    • The workaround guidance implies exposure arises when scanning untrusted content and when configuration is auto-loaded from the scanned directory.

    Remediation

    • Upgrade Checkov to version 3.3.25 or later.
    • Until patched, avoid running Checkov over untrusted content.
    • Pass configuration explicitly through a trusted configuration file instead of allowing auto-loading from the scanned directory.