Skip to content
Sign in
1.9 Low

CVE-2025-13425 A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice…

Description

A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.

Affected products and versions

Product Affected versions Fixed in
OSV-SCALIBR 0.3 earliest → < 0.3.4 0.3.4

Other CVEs of OSV-SCALIBR

The 3 CVEs of OSV-SCALIBR →
CVE-2026-102252 A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6… 6.9 Medium CVE-2025-5981 Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using… 5.7 Medium
Track this CVE