Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-102252

Path Traversal in VMDK Extractor in OSV-SCALIBR

A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive path entries allows file extractions to escape destination directories.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Osv-scalibr
CVE-2025-13425

Denial of Service in OSV-SCALIBR

A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.

CVSS 4.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Google
Products
Osv-scalibr
CVE-2025-5981

Arbitrary File write in OSV-SCALIBR

Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Osv-scalibr