CVE-2026-102252

UNKNOWN

Description

A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive path entries allows file extractions to escape destination directories.

Timeline

Published:September 29th, 2026 8:17 PM

Last modified:September 30th, 2026 4:17 PM

CVSS Scoring

No CVSS v3 score available

Weaknesses (CWE)

CWE-22 CWE-23

References & Reports

Advisories, patches, and third-party reports

https://github.com/google/osv-scalibr/pull/2030

Source: NIST NVD · Data may lag official sources by up to one minute