CVE-2026-85518

CVE-2026-85518 · Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.

CVSS 6.1 · Medium · EPSS 0.3%

Published

2026-10-21T19:42:54.174Z

Updated

2026-10-23T05:27:17.756Z

Check your server →