Medium severity · published Sep 29, 2026
CVE-2026-102252
Path Traversal in VMDK Extractor in OSV-SCALIBR
6.9
CVSS
0.1%
EPSS
No
On KEV
Description
A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive path entries allows file extractions to escape destination directories.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 0% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
OSV-SCALIBR · Google
0.3.6 before 0.5.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102252
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102252
github.com
https://github.com/google/osv-scalibr/pull/2030
More from OSV-SCALIBR
6.5
CVE-2025-5981
Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images