{"affected":[{"defaultStatus":"affected","ecosystem":"https://atomgit.com/src-openeuler/iSulad","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","source":"CNA: openEuler","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"cveId":"CVE-2026-111435","cwes":["CWE-23"],"description":"Relative path traversal vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nIn oci_load.c, oci_load_process_manifest() does not sanitize the Config path of manifest.json. A malicious tar package can enable the isulad with the root permission to read any file on the host.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.4,"severity":"high","source":"CNA: openEuler","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794455403418,"publishedAt":1794455403418,"references":[{"source":"CNA: openEuler","tags":["patch"],"url":"https://atomgit.com/openeuler/iSulad/commit/370889a81f1e7381de68ad7ded88b3439e266af5?ref=master&prId=2646"},{"source":"CNA: openEuler","tags":["patch"],"url":"https://atomgit.com/src-openeuler/iSulad/pull/812"}],"remediation":[{"kind":"fix","source":"CNA: openEuler","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://atomgit.com/openeuler/iSulad/commit/370889a81f1e7381de68ad7ded88b3439e266af5?ref=master&prId=2646"},{"kind":"fix","source":"CNA: openEuler","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"}],"revision":"b23cf91fdf24be73d2fdae69d984b0f1e8b17f00f860cc86ab7c52397eee0c7e","sources":[{"modifiedAt":1794455403418,"name":"CNA: openEuler","retrievedAt":1794456506629,"url":"https://www.cve.org/CVERecord?id=CVE-2026-111435"}],"ssvc":null,"status":"published","title":"CVE-2026-111435","updatedAt":1794456506629}