Live › vulnerability › CVE-2026-85518
Go to dashboardOpenSCAP does not validate relative file path attributes when decomposing a Source DataStream (SDS) file, so a crafted datastream with directory traversal sequences can make it create or modify files outside the intended directory. The attacker gets those writes with the permissions of the process running the decompose.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run OpenSCAP to decompose SDS datastreams, especially on automated scanning or compliance pipelines that accept datastreams from outside sources. Systems that never decompose SDS files, or only decompose datastreams they build themselves, are less exposed. The sources do not name the affected or fixed versions.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.
This page as .md · .json · in your agent: get_signal("CVE-2026-85518")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.