{"id":"CVE-2026-65951","kind":"vulnerability","aliases":["CVE-2026-65951"],"related":[],"title":"Lenovo XClarity OneCLI: crafted TAR.GZ package writes files outside target folder","description":"A path traversal vulnerability in the TAR.GZ extraction logic of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to write arbitrary files with the privileges of the OneCLI process by convincing a user to process a specially crafted TAR.GZ update package.","summary":"Lenovo XClarity Essentials OneCLI 5.5.0 for Linux mishandles paths when extracting TAR.GZ update packages. A user who is tricked into processing a specially crafted package lets an attacker write arbitrary files with the privileges of the OneCLI process.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Lenovo XClarity Essentials OneCLI","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["lenovo","linux","onecli","server-management","vendor","xclarity"],"not_affected_if":["not-5.5.0","other-os"],"how_to_check":"- Check the installed OneCLI version on Linux hosts, e.g. `onecli --version` (unknown if the sources do not give the command)\n- Look for OneCLI 5.5.0 in server management or patch tooling inventories\n- Review which update packages are processed and where they come from","fix":null,"status":"open","published_at":"2026-11-11T22:17:27+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","triaged_at":"2026-11-11T22:34:06+00:00","updated_at":"2026-11-11T22:34:06+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-11T22:34:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Lenovo XClarity OneCLI: crafted TAR.GZ package writes files outside target folder","impact":"high","summary":"Lenovo XClarity Essentials OneCLI 5.5.0 for Linux mishandles paths when extracting TAR.GZ update packages. A user who is tricked into processing a specially crafted package lets an attacker write arbitrary files with the privileges of the OneCLI process.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["lenovo","xclarity","onecli","linux","server-management"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker writes arbitrary files with OneCLI process privileges","analyst_note":"Confirm the fixed version and vendor advisory from Lenovo PSIRT; the NVD entry gives no fix.","how_to_check":"- Check the installed OneCLI version on Linux hosts, e.g. `onecli --version` (unknown if the sources do not give the command)\n- Look for OneCLI 5.5.0 in server management or patch tooling inventories\n- Review which update packages are processed and where they come from","plain_action":"","product_name":"Lenovo XClarity Essentials OneCLI","needs_analyst":true,"not_affected_if":["other-os","not-5.5.0"],"who_is_affected":"Teams that run Lenovo XClarity Essentials OneCLI 5.5.0 on Linux to manage server firmware or updates. Exposure requires a user to process an attacker-supplied TAR.GZ update package. Teams not running that version on Linux can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000771,"input_tokens":4577,"output_tokens":626,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-65951':14A,17A '5.5.0':34B,82C 'allow':86C 'arbitrari':59B,91C 'attack':57B,88C 'convinc':101C 'could':85C 'craft':4A,53B,108C 'cve':12A,15A 'essenti':32B,80C 'essentials':20A 'extract':40B,75C 'file':8A,60B,92C 'folder':11A 'lenovo':1A,18A,22B,30B,78C 'let':55B 'linux':23B,36B,84C 'logic':76C 'manag':27B 'mishandl':37B 'onec':3A,24B,33B,66B,81C,98C 'onecli':21A 'outsid':9A 'packag':6A,43B,54B,111C 'path':38B,69C 'privileg':63B,95C 'process':50B,67B,99C,105C 'server':26B 'server-manag':25B 'special':52B,107C 'tar.gz':5A,41B,74C,109C 'target':10A 'travers':70C 'trick':48B 'updat':42B,110C 'user':45B,103C 'vendor':28B 'vulner':71C 'write':7A,58B,90C 'xclariti':2A,29B,31B,79C 'xclarity':19A","nicknames":[],"mitigations":[],"who_affected":"Teams that run Lenovo XClarity Essentials OneCLI 5.5.0 on Linux to manage server firmware or updates. Exposure requires a user to process an attacker-supplied TAR.GZ update package. Teams not running that version on Linux can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["lenovoxclarityessentialsonecli","xclarityessentialsonecli"],"ptokens":["essentials","lenovo","onecli","xclarity"],"labels":["lenovo","linux","medium","onecli","servermanagement","vendor","xclarity"],"campaign_type":null,"search_a":"'-2026':13A,16A '-65951':14A,17A 'craft':4A 'cve':12A,15A 'essentials':20A 'file':8A 'folder':11A 'lenovo':1A,18A 'onec':3A 'onecli':21A 'outsid':9A 'packag':6A 'tar.gz':5A 'target':10A 'write':7A 'xclariti':2A 'xclarity':19A","search_b":"'5.5.0':34B 'arbitrari':59B 'attack':57B 'craft':53B 'essenti':32B 'extract':40B 'file':60B 'lenovo':22B,30B 'let':55B 'linux':23B,36B 'manag':27B 'mishandl':37B 'onec':24B,33B,66B 'packag':43B,54B 'path':38B 'privileg':63B 'process':50B,67B 'server':26B 'server-manag':25B 'special':52B 'tar.gz':41B 'trick':48B 'updat':42B 'user':45B 'vendor':28B 'write':58B 'xclariti':29B,31B","search_c":"'5.5.0':82C 'allow':86C 'arbitrari':91C 'attack':88C 'convinc':101C 'could':85C 'craft':108C 'essenti':80C 'extract':75C 'file':92C 'lenovo':78C 'linux':84C 'logic':76C 'onec':81C,98C 'packag':111C 'path':69C 'privileg':95C 'process':99C,105C 'special':107C 'tar.gz':74C,109C 'travers':70C 'updat':110C 'user':103C 'vulner':71C 'write':90C 'xclariti':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@lenovo.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65951","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65951","severity":null,"published_at":"2026-11-11T22:17:27+00:00","modified_at":"2026-11-11T22:17:27+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","fetched_at":"2026-11-11T22:29:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}