high7.3

CVE-2026-101295

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction.

Impact

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

Weakness classification

CWE-22

References

NVD record
CVE.org record
https://access.redhat.com/security/cve/CVE-2026-101295
https://bugzilla.redhat.com/show_bug.cgi?id=2522941
https://github.com/openshift/oc-mirror/blob/22a5722/v1/pkg/cli/mirror/catalog_images.go#L680
https://github.com/openshift/oc-mirror/blob/22a5722/v1/pkg/cli/mirror/fbc_operators.go#L334-L369