[CVE-2026-101295] Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirrori…

Descripción técnica

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.

Puntuación CVSS

Score: 7.3/10 — Severidad: HIGH — Estado NIST: Awaiting Analysis

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Debilidades (CWE)

CWE-22

Fuente oficial

Publicado en NIST NVD.