---
id: "CVE-2026-65951"
page: "https://infrastack.ai/live/CVE-2026-65951"
kind: "vulnerability"
aliases: ["CVE-2026-65951"]
title: "Lenovo XClarity OneCLI: crafted TAR.GZ package writes files outside target folder"
severity: "medium"
cvss: 5.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Lenovo XClarity Essentials OneCLI", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["lenovo", "linux", "onecli", "server-management", "vendor", "xclarity"]
not_affected_if: ["not-5.5.0", "other-os"]
published_at: "2026-11-11T22:17:27+00:00"
first_seen_at: "2026-11-11T22:29:34+00:00"
updated_at: "2026-11-11T22:34:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65951", "first_seen_at": "2026-11-11T22:29:34+00:00"}]
exploit_sources: []
---

# Lenovo XClarity OneCLI: crafted TAR.GZ package writes files outside target folder

Link for people: https://infrastack.ai/live/CVE-2026-65951 (this .md is for agents)

Lenovo XClarity Essentials OneCLI 5.5.0 for Linux mishandles paths when extracting TAR.GZ update packages. A user who is tricked into processing a specially crafted package lets an attacker write arbitrary files with the privileges of the OneCLI process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Lenovo XClarity Essentials OneCLI affected range not listed fixed no fixed version listed

## How to check

- Check the installed OneCLI version on Linux hosts, e.g. `onecli --version` (unknown if the sources do not give the command)
- Look for OneCLI 5.5.0 in server management or patch tooling inventories
- Review which update packages are processed and where they come from

## Timeline

- 2026-11-11T22:29:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65951

## From the sources

A path traversal vulnerability in the TAR.GZ extraction logic of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to write arbitrary files with the privileges of the OneCLI process by convincing a user to process a specially crafted TAR.GZ update package.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_