google/osv-scalibr · Security
OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal
- GHSA ID
- GHSA-2hcm-q3f4-fjgw
- CVE ID
- CVE-2025-5981
- Severity
- medium
- Published
- Updated
- CVSS v4
- 5.7 · CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Description
Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images.
CWEs
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-427 · Uncontrolled Search Path Element