{"id":"CVE-2026-85518","kind":"vulnerability","aliases":["CVE-2026-85518"],"related":[],"title":"OpenSCAP: crafted datastream can write files outside the target directory","description":"A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.","summary":"OpenSCAP does not validate relative file path attributes when decomposing a Source DataStream (SDS) file, so a crafted datastream with directory traversal sequences can make it create or modify files outside the intended directory. The attacker gets those writes with the permissions of the process running the decompose.","severity":"medium","cvss":6.1,"epss":0.00292,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["compliance-scanning","infrastructure","linux","openscap"],"not_affected_if":["no-sds-decompose","self-built-datastreams"],"how_to_check":"- unknown","fix":null,"status":"open","published_at":"2026-10-21T20:17:27+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:03:25+00:00","updated_at":"2026-10-25T04:03:25+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:03:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"OpenSCAP: crafted datastream can write files outside the target directory","impact":"medium","summary":"OpenSCAP does not validate relative file path attributes when decomposing a Source DataStream (SDS) file, so a crafted datastream with directory traversal sequences can make it create or modify files outside the intended directory. The attacker gets those writes with the permissions of the process running the decompose.","category":"infrastructure","nicknames":[],"who_cares":["openscap","linux","compliance-scanning"],"confidence":0.6,"needs_auth":"no","worst_case":"Arbitrary file writes outside target directory with process permissions","analyst_note":"Find the affected and fixed OpenSCAP versions and the upstream fix commit in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-85518).","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-sds-decompose","self-built-datastreams"],"who_is_affected":"Teams that run OpenSCAP to decompose SDS datastreams, especially on automated scanning or compliance pipelines that accept datastreams from outside sources. Systems that never decompose SDS files, or only decompose datastreams they build themselves, are less exposed. The sources do not name the affected or fixed versions.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00059,"input_tokens":3382,"output_tokens":503,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-85518':13A,16A 'allow':124C 'applic':85C 'attack':58B,101C 'attribut':30B,93C 'autom':111C 'complianc':18B 'compliance-scan':17B 'contain':118C 'craft':2A,40B,116C 'creat':49B 'creation':127C 'cve':11A,14A 'datastream':3A,35B,41B,81C,117C 'decompos':32B,70B,78C,114C 'directori':10A,43B,56B,119C,134C 'execut':140C 'exploit':103C,123C 'file':6A,28B,37B,52B,83C,91C,126C 'flaw':72C,105C 'found':74C 'get':59B 'infrastructur':20B 'intend':55B,132C 'lead':94C 'linux':21B 'make':47B 'modif':129C 'modifi':51B 'openscap':1A,22B,23B,76C 'outsid':7A,53B,130C 'path':29B,92C,97C 'permiss':64B,137C 'process':67B,141C 'proper':88C 'relat':27B,90C 'run':68B 'scan':19B 'sds':36B,82C 'sequenc':45B,121C 'sourc':34B,80C 'success':122C 'system':112C 'target':9A,133C 'travers':44B,98C,120C 'trick':107C 'unauthor':125C 'user':109C 'valid':26B,89C 'vulner':99C 'write':5A,61B","nicknames":[],"mitigations":[],"who_affected":"Teams that run OpenSCAP to decompose SDS datastreams, especially on automated scanning or compliance pipelines that accept datastreams from outside sources. Systems that never decompose SDS files, or only decompose datastreams they build themselves, are less exposed. The sources do not name the affected or fixed versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T20:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85518","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85518","severity":null,"published_at":"2026-10-21T20:17:27+00:00","modified_at":"2026-10-23T06:17:07+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-85518","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85518","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}