{"id":"CVE-2026-85518","title":"Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition","summary":"A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tric…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","cvssSource":"cna","cwe":["CWE-22"],"vendor":"Red Hat","product":"openscap","affected":["openscap (all versions)","openscap","openscap (all versions)","openscap (all versions)","openscap (all versions)","openscap (all versions)"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T19:42:54.174Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-85518","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-85518"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478522","label":"RHBZ#2478522"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T20:11:44.904Z","slug":"CVE-2026-85518","body":"## Overview\n\nA flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.\n\n## Affected\n\n- `openscap (all versions)`\n- `openscap`\n- `openscap (all versions)`\n- `openscap (all versions)`\n- `openscap (all versions)`\n- `openscap (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nAvoid extracting or decomposing untrusted SCAP Source DataStream (SDS) files. When processing externally supplied datastreams is necessary, perform the operation inside an isolated directory using a dedicated unprivileged user account or container sandbox with strictly bounded write privileges.\n\nCaveat: Operating under an unprivileged user confines rogue file creation to that user's access scope, but does not prevent file corruption within directories accessible to that account.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}