---
id: CVE-2026-85518
title: >-
  Openscap: openscap: arbitrary file write via path traversal in source
  datastream decomposition
summary: >-
  A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file,
  the application does not properly validate relative file path attributes,
  leading to a path traversal vulnerability. An attacker can exploit this flaw
  by tric…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-22
vendor: Red Hat
product: openscap
affected:
  - openscap (all versions)
  - openscap
  - openscap (all versions)
  - openscap (all versions)
  - openscap (all versions)
  - openscap (all versions)
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T19:42:54.174Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-85518'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-85518'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2478522'
    label: RHBZ#2478522
tags:
  - cve.org
ingestedAt: '2026-10-21T20:11:44.904Z'
---

## Overview

A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.

## Affected

- `openscap (all versions)`
- `openscap`
- `openscap (all versions)`
- `openscap (all versions)`
- `openscap (all versions)`
- `openscap (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Avoid extracting or decomposing untrusted SCAP Source DataStream (SDS) files. When processing externally supplied datastreams is necessary, perform the operation inside an isolated directory using a dedicated unprivileged user account or container sandbox with strictly bounded write privileges.

Caveat: Operating under an unprivileged user confines rogue file creation to that user's access scope, but does not prevent file corruption within directories accessible to that account.