CVE-2026-102252

Name of the Vulnerable Software and Affected Versions Google OSV-SCALIBR versions 0.3.6 through 0.5.0

Description A path traversal issue in the embedded VMDK filesystem extractor allows an attacker who controls the scan target to write arbitrary files to the host system. This occurs when scanning crafted VMDK images because insufficient validation of archive path entries allows file extractions to escape destination directories. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the intended folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.