---
id: "CVE-2026-65950"
page: "https://infrastack.ai/live/CVE-2026-65950"
kind: "vulnerability"
aliases: ["CVE-2026-65950"]
title: "Lenovo XClarity OneCLI: crafted ZIP update package writes arbitrary files"
severity: "medium"
cvss: 5.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Lenovo XClarity Essentials OneCLI", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["lenovo", "linux", "server-management", "vendor", "xclarity-essentials-onecli"]
not_affected_if: ["other-platforms", "untrusted-packages-never-processed"]
published_at: "2026-11-11T22:17:27+00:00"
first_seen_at: "2026-11-11T22:29:34+00:00"
updated_at: "2026-11-11T22:34:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65950", "first_seen_at": "2026-11-11T22:29:34+00:00"}]
exploit_sources: []
---

# Lenovo XClarity OneCLI: crafted ZIP update package writes arbitrary files

Link for people: https://infrastack.ai/live/CVE-2026-65950 (this .md is for agents)

Lenovo XClarity Essentials OneCLI 5.5.0 for Linux has a path traversal flaw in its ZIP extraction logic. A user who is tricked into processing a specially crafted ZIP-based update package lets an attacker write arbitrary files with the privileges of the OneCLI process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Lenovo XClarity Essentials OneCLI affected range not listed fixed no fixed version listed

## Timeline

- 2026-11-11T22:29:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65950

## From the sources

A path traversal vulnerability in the ZIP extraction logic of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to write arbitrary files with the privileges of the OneCLI process by convincing a user to process a specially crafted ZIP-based update package.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_