CVE-2026-102252 — Path Traversal in VMDK Extractor in OSV-SCALIBR

CVE-2026-102252

Path Traversal in VMDK Extractor in OSV-SCALIBR PUBLISHED

Description (CNA)

A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive path entries allows file extractions to escape destination directories.

Affected (CNA)

Vendor / product	Versions
Google / OSV-SCALIBR	affected 0.3.6 before 0.5.1

CWE

CWE-22, CWE-23

References

https://github.com/google/osv-scalibr/pull/2030

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.