Skip to content
Sign in
5.7 Medium

CVE-2025-5981 Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using…

Description

Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images.

Affected products and versions

Product Affected versions Fixed in
OSV-SCALIBR 0.1 0.1.3 → < 0.1.8 0.1.8

Other CVEs of OSV-SCALIBR

The 3 CVEs of OSV-SCALIBR →
CVE-2026-102252 A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6… 6.9 Medium CVE-2025-13425 A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice… 1.9 Low
Track this CVE