Executive brief
Trivy is a vulnerability scanner that downloads security databases and configuration bundles from container registries. When an attacker controls the source repository, they can craft a malicious annotation in the container manifest to write files to arbitrary locations on the scanning system. This could allow an attacker to modify SSH keys, shell configurations, or other files to achieve code execution with the privileges of the user running Trivy.
Technical details
This is a path traversal vulnerability (CWE-22) in Trivy's OCI artifact handling. When Trivy downloads vulnerability databases, Java vulnerability databases, misconfiguration checks bundles, or WASM modules, it extracts the destination filename from the org.opencontainers.image.title annotation in the artifact manifest without validating or sanitizing the path. An attacker can supply a value like "../../../../tmp/malicious.sh" to place files outside the intended destination directory. Exploitation requires the attacker to control the OCI repository URL, which can be specified via --db-repository, --java-db-repository, --checks-bundle-repository flags or corresponding environment variables/config file settings. The attack is practical in scenarios where users copy commands from untrusted sources or use compromised mirrors. Default Trivy configuration (using Aqua-operated repositories) is unaffected. The vulnerability was patched in Trivy 0.71.1.
Affected products
- Aqua Security Trivy < 0.71.1
Timeline
- 2026-06-15: disclosed
- 2026-06-15: patched: Patch released as Trivy 0.71.1
- 2026-08-25: advisory