CVE-2026-14468CWE-22

Path traversal allows arbitrary file read in Terraform Enterprise container

High · published July 6, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
37.5
In the wild
Unconfirmed
What it is

HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry modules that did not correctly enforce the intended boundary on packaged module content. This may allow an authenticated user to include files from outside the intended repository content in a module and then download them, potentially exposing sensitive files readable by the ingestion process. This vulnerability, CVE-2026-14468, is fixed in Terraform Enterprise v2.0.4 and v1.2.4.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00443 · 37.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-06T20:59Z
EPSS history
Timeline
  • 06 JUL 20:59Z
    Path traversal allows arbitrary file read in Terraform Enterprise container
    cvelistv5