CVE-2026-102252 in OSV-SCALIBR
Summary
by MITRE • 09/29/2026
A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive path entries allows file extractions to escape destination directories.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 represents a critical security flaw within the embedded Virtual Machine Disk (VMDK) filesystem extractor component. This issue is classified under Common Weakness Enumeration identifier CWE-22, which denotes Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The core technical failure lies in the insufficient validation and sanitization of archive path entries during the extraction process. When the tool processes VMDK images, it fails to adequately verify that file paths contained within the disk image are strictly confined to the intended destination directory. This lack of rigorous boundary checking allows maliciously crafted inputs to manipulate relative or absolute path references, effectively bypassing the sandboxed environment designed for safe analysis.
From an operational perspective, this vulnerability poses a severe risk because it enables arbitrary file write operations on the host system where OSV-SCALIBR is executed. An attacker who controls the scan target can construct a malicious VMDK image containing specially crafted path entries that escape the extraction directory. Upon processing such an image, the vulnerable component interprets these paths without proper normalization or restriction, resulting in files being written to arbitrary locations on the host filesystem. This capability transforms what is ostensibly a security scanning tool into a potential vector for system compromise. The attacker could overwrite critical configuration files, inject malicious scripts, or establish persistence mechanisms by placing executables in sensitive directories such as /etc, /usr/bin, or user home directories with elevated privileges depending on the execution context of the scanner.
The implications extend beyond simple file overwriting. By leveraging this path traversal flaw, an attacker can potentially achieve remote code execution if they can place a malicious binary in a location that is subsequently executed by privileged processes or users. Furthermore, the ability to write arbitrary files facilitates data exfiltration preparation or sabotage of system integrity. In environments where OSV-SCALIBR is used for automated vulnerability scanning of virtual machine images, this flaw undermines the trust model entirely. Security tools are expected to be safe against untrusted inputs; however, in this case, a trusted tool becomes an attack vector when processing maliciously constructed artifacts. This aligns with ATT&CK technique T1048, which covers Exfiltration Over Alternative Protocol, as well as techniques related to persistence and privilege escalation via file system manipulation.
Mitigation strategies must focus on immediate remediation through version updates and enhanced input validation practices for future development. The primary corrective action is to upgrade OSV-SCALIBR to a patched version that addresses this path traversal issue by implementing strict canonicalization of all extracted paths before writing them to disk. Developers should ensure that the resolved absolute path of each file remains within the designated extraction directory, rejecting any entry where the parent directories do not match the expected scope. Additionally, employing chroot jails or containerized execution environments for running such tools can provide an additional layer of defense by isolating the filesystem access even if validation fails. Organizations currently using versions 0.3.6 through 0.5.0 should immediately cease scanning untrusted VMDK images until a patched version is deployed and audit their systems for any signs of unauthorized file modifications that may have resulted from prior exploitation attempts.