Prisma Cloud Checkov EUVD-2026-101675

Exploitation requires that a victim run Checkov to scan attacker-controlled or untrusted content (e.g., a malicious IaC file, module, or repository) - this is the passive user interaction (UI:P) in the vector. The attacker needs local access to the scanning filesystem context by influencing the scanned input, but no authentication to Checkov itself (PR:N). Limiting factors: the flaw is not remotely exploitable over a network (AV:L), it depends on the victim scanning hostile input rather than any default-configuration remote trigger, and impact is confined to file writes on the host performing the scan. Environments that only scan trusted, internally-authored IaC are at substantially lower practical risk.

This is a genuinely low-priority issue despite the CWE-22 (path traversal) classification. All signals align downward: the CVSS 4.0 base score is 4.3 (Medium), the vector is strictly local (AV:L) with passive user interaction required (UI:P), and exploit maturity is Unproven (E:U), meaning no public exploit exists. The only meaningful impact is integrity (VI:H) via arbitrary file write on the host running the scan; confidentiality and availability are rated N. There is no EPSS score, no CISA KEV listing, and no POC provided in the intelligence - so there is no evidence of real-world exploitation or weaponization. The one nuance to flag: the description says 'unauthenticated local user,' and the vector agrees (PR:N, AV:L). This is not a network-exploitable flaw - the attacker's leverage comes from supplying malicious content (e.g., an IaC file or repository) that a victim then scans with Checkov, so exposure is gated by whether operators scan untrusted/attacker-influenced input. Treat as a standard patch-on-cycle item, not an emergency; the high-integrity-impact label should not be mistaken for high real-world risk given the local vector and absence of exploitation signals.

An attacker crafts a malicious Infrastructure-as-Code file or repository containing path-traversal sequences and gets a victim to scan it with Checkov (for example, a CI pipeline or a developer running a scan on an untrusted pull request). When Checkov processes the crafted content, it writes attacker-controlled files to arbitrary locations on the scanning host's filesystem, potentially overwriting configuration or scripts. No public exploit code is identified at time of analysis, and the local vector plus required user interaction limit this to targeted, opportunistic abuse.