CVE-2026-102252
Path Traversal in VMDK Extractor in OSV-SCALIBR
Google OSV-SCALIBR
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.09%Chance of exploitation activity in the next 30 days, higher than 0% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.5.1OSV-SCALIBRCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive path entries allows file extractions to escape destination directories.
Text from CVE List
Affected versions 1
- OSV-SCALIBRaffected: 0.3.6 before 0.5.1CVE List