CVE-2026-102252CWE-22CWE-23path-traversal

CVE-2026-102252

published September 30, 2026

CVSS
6.9
EPSS
0%
Percentile
0.4
In the wild
Unconfirmed
What it is

A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive path entries allows file extractions to escape destination directories.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00088 · 0.4th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-23 · Relative Path Traversal
Published
2026-09-30T00:17Z
References (1)
https://github.com/google/osv-scalibr/pull/2030 · [email protected]
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 19:41Z
    Path Traversal in VMDK Extractor in OSV-SCALIBR
    cvelistv5