Can unauthenticated users write files via Checkov 3.3 path traversal?
Palo Alto Networks reports path traversal flaws in Checkov 3.3 that let local users write to arbitrary filesystem locations without authentication.
Key points
- CVE-2026-0312 allows unauthenticated local users to write files to arbitrary locations on the scanning filesystem.
- The flaw affects Checkov by Prisma Cloud version 3.3.0 up to, but not including, version 3.3.25.
- Palo Alto Networks advises avoiding scans of untrusted content and using explicit trusted configuration files until patched.
Palo Alto Networks disclosed CVE-2026-0312, a path traversal vulnerability in its Checkov by Prisma Cloud product. This flaw enables an unauthenticated local user to write files to arbitrary locations on the scanning filesystem. The issue requires no special configuration to be exploitable, making standard deployments susceptible if local access is granted.
Root cause
The vulnerability is classified as CWE-22 Improper Limitation of a Pathname to a Restricted Directory. It is described as path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma Cloud. The source material does not specify the internal code logic or mechanism causing the improper limitation.
Attack path
An attacker must be an unauthenticated local user. They can write files to arbitrary locations on the scanning filesystem. No special configuration is required to be affected by this issue. The CVSS vector indicates the attack vector is local, attack complexity is low, and privileges required are none.
Affected versions
- Checkov by Prisma Cloud version 3.3.0
- Checkov by Prisma Cloud versions up to, but not including, 3.3.25
- Any minor version within this range is considered vulnerable
Mitigation
- Avoid running Checkov over untrusted content until a fixed version is deployed.
- Pass configuration explicitly via a trusted configuration file rather than allowing auto-loading from the scanned directory.
- Monitor for vendor updates that address CVE-2026-0312.
What it means for organisations
Teams should assess which systems run vulnerable Checkov versions and review local access controls. Security leads must notify infrastructure managers about the risk of arbitrary file writes. Review supplier contracts to ensure timely patching. Check whether scanning environments process untrusted code. Verify that configuration loading follows strict trusted sources. Ensure incident response plans cover local privilege escalation. Communicate risks to development teams using these tools.
What to do and how to stay safe: Palo Alto Networks
- Audit local user permissions on systems running Checkov to limit potential attackers.
- Configure Checkov to use explicit trusted configuration files instead of auto-loading settings.
- Restrict scanning operations to trusted content only until a patch is available.
- Monitor system logs for unusual file write activities in scanning directories.
Step-by-step guide: Patch Testing Best Practices That Prevent Production Failures
General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is CVE-2026-0312 being exploited in the wild?
Palo Alto Networks is not aware of any malicious exploitation of these issues.
What is the severity of CVE-2026-0312?
The severity is rated as MEDIUM with a suggested urgency of MODERATE.
Which versions of Checkov are affected?
Versions from 3.3.0 up to, but not including, 3.3.25 are vulnerable.
