CVE-2026-85518

Description

A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.

Traduire en français

Produits concernés

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat Hardened Images

Scores CVSS

Faiblesses (CWE)

• CWE-22

Références

• https://access.redhat.com/security/cve/CVE-2026-85518
• https://bugzilla.redhat.com/show_bug.cgi?id=2478522

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories