CVE-2026-85518
Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition
A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.
Fixes and workarounds
Workaround
Avoid extracting or decomposing untrusted SCAP Source DataStream (SDS) files. When processing externally supplied datastreams is necessary, perform the operation inside an isolated directory using a dedicated unprivileged user account or container sandbox with strictly bounded write privileges. Caveat: Operating under an unprivileged user confines rogue file creation to that user's access scope, but does not prevent file corruption within directories accessible to that account.
Source: CNA: redhatAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| Red Hat Hardened Images Red Hat openscap-main
https://catalog.redhat.com/software/containers/ |
≥ 1.4.5-2.1.hum1; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 10 Red Hat openscap
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 6 Red Hat openscap
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat Enterprise Linux 7 Red Hat openscap
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 8 Red Hat openscap
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 9 Red Hat openscap
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 6.1 medium |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L | CNA: redhat |
Exploit evidence
- https://bugzilla.redhat.com/show_bug.cgi?id=2478522
exploit · ADP: CISA-ADP
References
- https://access.redhat.com/errata/RHSA-2026:88330CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-85518CNA: redhat · vdb-entry, x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2478522CNA: redhat · issue-tracking, x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2478522ADP: CISA-ADP · exploit
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.