A flaw was found in OSV-SCALIBR. This vulnerability allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning a crafted Virtual Machine Disk (VMDK) image, insufficient validation of archive path entries in the embedded filesystem extractor allows extracted files to escape the intended destination directory.
Last checked: 2026-10-22 16:09 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-30 15:20 UTC)
Fix evidence last checked: 2026-09-30 05:28 UTC