PVD-20260906-D960: Trivy Implicit Configuration Allows Arbitrary File Overwrite and Second-Stage Code Execution

Summary

Trivy loads trivy.yaml from its current working directory by default. If that directory is an untrusted repository checkout, the repository can select a report template and an arbitrary output path. Trivy then creates or truncates that path with attacker-selected text.

A writable script or other file used by a later trusted step can therefore be replaced, leading to conditional second-stage code execution with the scanner account's privileges. Even without a later execution step, this is an arbitrary file-overwrite primitive with integrity and availability impact.

Reporter assessment: High.
Upstream report: GHSA-w2p7-mh9r-rp32 (closed, unpublished).
Behavior present: Source history indicates Trivy 0.30.0 onward, including 0.75.0. The proof of concept was run against 0.74.0.

An attacker-controlled checkout needs only active report settings such as:

format: template
template: attacker-controlled text
output: ../trusted-next-step.sh

Trivy passes the configured path to os.Create. Overwriting an existing executable preserves its executable mode, so a later pipeline step that invokes the same path runs the replacement. The scanner must be able to write the target, and code execution requires a later trigger; this is not immediate command execution inside Trivy.

Aqua Security closed the report as out of scope, explaining that Trivy treats trivy.yaml as trusted execution configuration and recommends an absolute, pipeline-owned --config when scanning untrusted content.

Trivy 0.75.0, released 2026-10-01, added explicit configuration security guidance and support for --config="" to disable configuration-file loading. Those are useful mitigations, but the default still trusts trivy.yaml in the working directory; there is no patched release or CVE for this report.

On 2026-10-05, Aqua maintainer Dmitriy Lewen confirmed that publication did not need to be held and asked that Aqua's assessment be represented accurately. Aqua also emphasized that practical impact remains bounded by the calling job's existing permissions. We appreciate Aqua's clear public response and the added guidance.

• Pass an absolute path to a read-only, pipeline-owned configuration outside the checkout.
• With Trivy 0.75.0 or later, use --config="" when no configuration file is needed.
• Start Trivy from a trusted directory and pass the checkout as the scan target.
• Use an unprivileged, disposable runner with a read-only source mount and narrowly scoped writable output/cache directories.

This was found while implementing native Ada/Alire dependency inventory and SBOM support in Trivy for use by Pragmatic Scanner. Pragmatic Scanner itself did not detect the issue. The related feature work is described in Trivy discussion #11244.

• Aqua's public disclosure and out-of-scope response.
• Trivy 0.75 configuration security considerations.
• Trivy PR #11210: disable configuration files with empty paths.
• Trivy 0.75 output-file creation path.

• 2026-09-06: Behavior reproduced and privately reported to Aqua Security.
• 2026-09-11: Aqua merged expanded configuration guidance and the explicit configuration-disable option.
• 2026-09-21: Aqua closed the report as out of scope; PVD record reserved.
• 2026-10-01: Trivy 0.75.0 shipped the new guidance and --config="" mitigation.
• 2026-10-05: Aqua publicly confirmed its assessment and that publication need not be delayed.