# CVE-2026-13748: Snowflake CLI path traversal in project file processing

Source: https://junglewise.ai/threats/cve-2026-13748-snowflake-cli-path-traversal-in-project-file-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-13748 · Severity: medium · CVSS 6.3 · Published 2026-06-29

Snowflake CLI, a command-line tool used by developers to manage Snowflake data platforms, is vulnerable to a file exposure flaw. An attacker could provide a malicious project file that, when processed by a user, causes the tool to secretly read and upload sensitive files from the user's local computer to the Snowflake cloud environment. This could lead to the unauthorized exposure of private local data if an attacker has access to the victim's Snowflake account history or storage areas.

Technologies: [Snowflake CLI](https://junglewise.ai/threats/technologies/snowflake-cli). Vendors: [Snowflake](https://junglewise.ai/threats/vendors/snowflake).

## Quick answers

**Is CVE-2026-13748 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13748 being exploited in the wild.

**How severe is CVE-2026-13748?** Medium severity, with a CVSS score of 6.3, published 29 June 2026.

**Which products and versions are affected?** Snowflake CLI 0.2.2 to 3.18.x (fixed in 3.19.0).

**Is there a fix for CVE-2026-13748?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13748 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-13748?** Check whether you run Snowflake CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in Snowflake CLI versions prior to 3.19 due to improper restriction of file path resolution. The flaw is triggered when the CLI processes crafted repository or project content, such as SQL templates or deployment configurations, that reference files outside the intended project boundary (including via symlinks, CWE-61). An attacker can exploit this by tricking a victim into processing malicious project files, causing the CLI to read local files and upload them to Snowflake stages or embed them in query history. Remediation requires a manual upgrade to Snowflake CLI version 3.19.

## Affected products

- Snowflake Snowflake CLI 0.2.2 to 3.18.x (fixed in 3.19.0)

## Timeline

- 2026-06-29: advisory
- 2026-06-29: disclosed

## References

- [https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory](https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory)

## Related threats

- [Snowflake CLI SQL injection via improper input validation](https://junglewise.ai/threats/cve-2026-92903-snowflake-cli-sql-injection-via-improper-input-validation)
- [Snowflake CLI SQL injection in command parameters](https://junglewise.ai/threats/cve-2026-13752-snowflake-cli-sql-injection-in-command-parameters)
- [Snowflake CLI SSRF and Remote SQL Execution in SQL Reader](https://junglewise.ai/threats/cve-2026-13751-snowflake-cli-ssrf-and-remote-sql-execution-in-sql-reader)
- [Snowflake CLI sensitive information disclosure in local logs](https://junglewise.ai/threats/cve-2026-13750-snowflake-cli-sensitive-information-disclosure-in-local-logs)
- [Snowflake CLI SQL injection in local CLI parameters](https://junglewise.ai/threats/cve-2026-13746-snowflake-cli-sql-injection-in-local-cli-parameters)