Palo Alto Networks Checkov 3.3 Has Medium Severity Path Traversal Flaw
Unauthenticated local users can write files anywhere in Checkov 3.3, though no malicious exploitation is currently known.
Key points
- CVE-2026-0312 allows unauthenticated local users to write files to arbitrary locations on the scanning filesystem.
- The vulnerability affects Checkov by Prisma Cloud version 3.3.0 up to, but not including, version 3.3.25.
- Palo Alto Networks rates the issue as Medium severity with a CVSS-BT score of 4.3 and no special configuration required.
Palo Alto Networks disclosed path traversal vulnerabilities in its Checkov by Prisma Cloud product, identified as CVE-2026-0312. The advisory states that these flaws enable unauthenticated local users to write files to arbitrary locations on the scanning filesystem. This capability could compromise the integrity of the system running the security scanner.
The vendor rates the severity of this issue as Medium, with a suggested urgency of Moderate. The Common Vulnerability Scoring System base temporal metric assigns a score of 4.3, while the base metric score is 6.8. The vulnerability classification is CWE-22, which refers to improper limitation of a pathname to a restricted directory. No special configuration is required for a system to be affected by this issue.
Context and Background
Palo Alto Networks stated that it is not aware of any malicious exploitation of these issues in the wild. This disclosure follows a pattern of path traversal flaws reported in other software products recently. For instance, as Threat Times reported on October 13, 2026, Adobe ColdFusion had a critical path traversal flaw, and Microsoft Dynamics NAV 2018 had a high-severity elevation of privilege vulnerability involving similar path traversal mechanics.
The specific vector for Checkov involves local access. The CVSS vector string indicates that the attack vector is Local (AV:L), with Low complexity (AC:L) and No privileges required (PR:N). However, user interaction is specified as necessary (UI:P). The impact is primarily on integrity, rated High (VI:H), while confidentiality and availability impacts are rated None.
Who Is Affected
The vulnerability affects Checkov by Prisma Cloud version 3.3.0 and all subsequent versions up to, but not including, version 3.3.25. Any organization using these specific versions of the tool is potentially exposed to the risk of arbitrary file writes by local users. The CPE identifier for the affected product is cpe:2.3:a:palo_alto_networks:checkov_by_prisma_cloud.
Users should verify their current installation version immediately to determine if they fall within the vulnerable range. The advisory explicitly marks versions from 3.3.0 up to 3.3.25 as vulnerable. Organizations relying on automated configuration loading from scanned directories may face higher exposure until they apply the recommended mitigations.
What should you do?
Palo Alto Networks advises users to avoid running Checkov over untrusted content until a fixed version is deployed. Additionally, users should pass configuration explicitly via a trusted configuration file rather than allowing configuration to be auto-loaded from the scanned directory. These steps reduce the risk of an attacker leveraging the path traversal flaw to inject malicious configurations or files.
What to do and how to stay safe: Palo Alto Networks
- Verify your installed version of Checkov by Prisma Cloud to see if it is between 3.3.0 and 3.3.25.
- Stop scanning untrusted code repositories or content until you can apply vendor-recommended mitigations.
- Configure your scanning environment to use explicit, trusted configuration files instead of auto-loading settings from the target directory.
- Monitor official vendor channels for the release of version 3.3.25 or later, which is expected to resolve the issue.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-0312?
The CVSS-BT score is 4.3 and the CVSS-B score is 6.8, with a Medium severity rating.
Which versions of Checkov are affected by this vulnerability?
Versions from 3.3.0 up to, but not including, 3.3.25 are vulnerable to this path traversal flaw.
Is there a patch available for this vulnerability yet?
No fixed version has been confirmed as deployed yet; users are advised to apply mitigations until version 3.3.25 is available.
