CVE-2026-102252

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-102252

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102252.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-102252

Published

2026-09-29T19:41:42Z

Modified

2026-10-02T03:30:51Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Path Traversal in VMDK Extractor in OSV-SCALIBR

Details

A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive path entries allows file extractions to escape destination directories.

Database specific

{
    "cna_assigner":  "Google",
    "cwe_ids":  [
        "CWE-22",
        "CWE-23"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102252.json"
}

References

Affected packages

Git / github.com/google/osv-scalibr

Affected ranges

Type

GIT

Repo

https://github.com/google/osv-scalibr

Events

Introduced

7d6aea59ad124481759e3d28a73105085983ff72

Fixed

eb1ca153f805d948e98a7079536833e8ff88bb31

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.3.6"
        },
        {
            "fixed":  "0.5.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*

v0.3.6

v0.4.0

v0.4.1

v0.4.2

v0.4.3

v0.4.4

v0.4.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102252.json"