CVE-2026-101295 in Assisted Installer for OpenShift Container Platform
Сводка
по VulDB • 30.09.2026
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.