CVE-2026-0312 Checkov by Prisma Cloud: Path Traversal Vulnerabilities
Description
Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem.
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Checkov by Prisma Cloud | < 3.3.25 | >= 3.3.25 |
Required Configuration for Exposure
No special configuration is required to be affected by this issue.
Severity: MEDIUM, Suggested Urgency: MODERATE
CVSS-BT: 4.3 / CVSS-B: 6.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber)
Exploitation Status
Palo Alto Networks is not aware of any malicious exploitation of these issues.
Weakness Type and Impact
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Solution
| Version | Minor Version | Suggested Solution |
|---|---|---|
| Checkov by Prisma Cloud 3.3 | 3.2.0 through 3.3.24 | Upgrade to 3.3.25 or later. |
Checkov integration in Prisma Cloud is upgraded automatically when new versions become available.
Workarounds and Mitigations
Until a fixed version is deployed, avoid running Checkov over untrusted content, and pass configuration explicitly via a trusted configuration file rather than allowing configuration to be auto-loaded from the scanned directory.
Acknowledgments
CPE Applicability
- cpe:2.3:a:palo_alto_networks:checkov_by_prisma_cloud:*:*:*:*:*:*:*:* is vulnerable from (including)3.3.0 and up to (excluding)3.3.25