[ CVE-2026-102252 · Published 29 Sep 2026 ]
Vulnerability in Google OSV-SCALIBR
CVSS 6.9
EPSS <1%No fix listed yet
[ Description ]Official description
A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive path entries allows file extractions to escape destination directories.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.