CVE-2026-101295

What it is

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.

At a glance

Exploitability

Can be exploited locally on the machine without logging in, but needs a user to act. High risk of data exposure, data tampering.

Exploit odds

0.1% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-09-28 13:01 UTC ReservedThe CVE id was reserved by its CNA
2. 2026-09-30 15:22 UTC PublishedDisclosed publicly on CVE.org and NVD
3. 2026-10-30 09:17 UTC Last updatedMost recent change to the record

Details

Published

2026-09-30 15:22 UTC

Last modified

2026-10-30 09:17 UTC

Exploit probability

0.1% · EPSS, next 30 days

Weakness

CWE-22 · Path traversal

Record status

Awaiting Analysis

Attack profile CVSS 3.1 · 7.3

Attack vector

Local

Complexity

Low

Privileges needed

None

User interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low