PT-2025-25778

CVE-2025-5981

Published

2025-06-18

Updated

2025-08-04

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OSV-SCALIBR (affected versions not specified)

Description The issue allows for arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. This is particularly problematic when using the CLI flag --remote-image on untrusted container images.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-427: Uncontrolled Search Path Element

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers

CVE-2025-5981