CVE-2026-85518— Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenSCAP 中存在一个安全漏洞。在解构源数据流（SDS）文件时，应用程序未能正确验证相对文件路径属性，从而导致路径遍历漏洞。攻击者可诱使用户或自动化系统解构包含目录遍历序列的恶意数据流，利用该漏洞。成功利用后，攻击者可在目标目录之外，以执行进程的权限创建或修改未授权的文件。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85518
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
II. Public POCs for CVE-2026-85518
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85518
请登录查看更多情报信息。
Other References for CVE-2026-85518 (2)
Same Patch Batch · Red Hat · 2026-10-21 · 11 CVEs total
| CVE-2026-110744 | 7.2 HIGH | Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impe |
| CVE-2026-114406 | 6.8 MEDIUM | Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns |
| CVE-2026-17557 | 6.5 MEDIUM | Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer cred |
| CVE-2026-92824 | 6.2 MEDIUM | Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts |
| CVE-2026-92822 | 6.2 MEDIUM | Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml |
| CVE-2026-92823 | 6.2 MEDIUM | Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml |
| CVE-2026-114038 | 5.1 MEDIUM | Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed for |
| CVE-2026-114438 | 4.2 MEDIUM | Keycloak-services: keycloak-services: required otp enrollment bypassed via update user loc |
| CVE-2026-114370 | 3.7 LOW | Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink t |
| CVE-2026-114236 | 3.3 LOW | Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompre |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-92824
Libmodulemd: libmodulemd: out-of-bounds read when emitting r -
CVE-2026-92823
Libmodulemd: libmodulemd: missing decompressed-size limit wh -
CVE-2026-92822
Libmodulemd: libmodulemd: unbounded recursion when parsing n -
CVE-2026-114038
Device-mapper-multipath: device-mapper-multipath: informatio -
CVE-2026-113496
Cockpit-machines: vnc console password disclosure through vi
Same vendor: Red Hat
-
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificat -
CVE-2026-114438
Keycloak-services: keycloak-services: required otp enrollmen -
CVE-2026-110744
Multicluster-global-hub-operator-bundle: operator serviceacc -
CVE-2026-114370
Undertow: undertow: pathresourcemanager safepaths check allo -
CVE-2026-114236
Podman: goroutine/file-descriptor leak in storage/pkg/archiv
Same weakness: CWE-22
-
CVE-2026-114140
nbconvert: File write via path traversal in cell output file -
CVE-2026-114377
leomoon-studios wiki-go Comment Deletion comments.go DeleteC -
CVE-2026-114376
leomoon-studios wiki-go API editor.go SourceHandler path tra -
CVE-2026-114375
leomoon-studios wiki-go Files Rename API files.go RenameFile -
CVE-2026-105945
Apache Pulsar: Improper Validation of Package Name Component
V. Comments for CVE-2026-85518
No comments yet