CVE-2026-102252
A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google…
- Risk score
- 42/100
- CVSS
- 6.9 v4.0
- Exploit chance (30 days)
- 0.1%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive path entries allows fil…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.9 medium
References
Original description
A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive path entries allows file extractions to escape destination directories.
Last activity 29 Sep 2026. Patch Forecast updates every hour.