Skip to content
OpenAdvisories

Product · Google

OSV-SCALIBR

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-102252

    Path Traversal in VMDK Extractor in OSV-SCALIBR

    A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images…

    Google OSV-SCALIBR
  • Medium 5.7
    CVE-2025-5981

    Arbitrary File write in OSV-SCALIBR

    Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images.

    Google OSV-SCALIBR github.com/google/osv-scalibr Go