MinorCritical vulnerability

CVE-2026-101295 (CVSS 7.3)

NVD · officialPublished Sep 30, 2026Risk 23/100

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.

Technical details

CVSS

7.3

AV:LocalAC:LowPR:NoneUI:RequiredC:HighI:HighA:Low

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source