CVEvulnerability
CVE-2026-101295
7.3 HIGH
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-09-30
- Last modified
- 2026-09-30
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.3 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
- Weaknesses
- CWE-22
Description
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://access.redhat.com/security/cve/CVE-2026-101295 access.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2522941 bugzilla.redhat.com
- https://github.com/openshift/oc-mirror/blob/22a5722/v1/pkg/cli/mirror/catalog_images.go#L680 github.com
- https://github.com/openshift/oc-mirror/blob/22a5722/v1/pkg/cli/mirror/fbc_operators.go#L334-L369 github.com