{"affected":[{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"assisted/agent-preinstall-image-builder-rhel9","product":"Assisted Installer for Red Hat OpenShift Container Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/oc-mirror-plugin-rhel8","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/oc-mirror-plugin-rhel9","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift5/oc-mirror-plugin-rhel9","product":"Red Hat OpenShift Container Platform 5","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-101295","cwes":["CWE-22"],"description":"Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.","epss":{"date":"2026-11-06","percentile":0.03801,"score":0.00145},"exploits":[],"kev":null,"metrics":[{"score":7.3,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","version":"3.1"}],"modifiedAt":1794005067022,"publishedAt":1790777176437,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-101295"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2522941"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/openshift/oc-mirror/blob/22a5722/v1/pkg/cli/mirror/catalog_images.go#L680"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/openshift/oc-mirror/blob/22a5722/v1/pkg/cli/mirror/fbc_operators.go#L334-L369"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"revision":"ab699f5b5ba418afe99d702d9b2f50b99191b56198fc7fc53952199c08b9e812","sources":[{"modifiedAt":1794005067022,"name":"CNA: redhat","retrievedAt":1794006506295,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101295"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794006566967,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101295"}],"ssvc":{"assessedAt":1790797380483,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction","updatedAt":1794006566967}