CVE-2025-5981 | THREATINT

Description

Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images.

Reserved 2025-06-10 | Published 2025-06-18 | Updated 2025-06-18 | Assigner Google

MEDIUM: 5.7CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Problem types

CWE-427 Uncontrolled Search Path Element

Product status

Default status

unaffected

0.1.3 before 0.1.8

affected

Credits

Anthony Weems of Google's Cloud Vulnerability Research team finder

Simon Scannell of Google's Cloud Vulnerability Research team finder

Stefan Schiller of Google's Cloud Vulnerability Research team finder

References

github.com/google/osv-scalibr/releases/tag/v0.1.8

github.com/...ommit/2444419b1818c2d6917fc3394c947fb3276e9d59

cve.org (CVE-2025-5981)

nvd.nist.gov (CVE-2025-5981)

Download JSON