---
id: "CVE-2026-85518"
kind: "vulnerability"
aliases: ["CVE-2026-85518"]
title: "OpenSCAP: crafted datastream can write files outside the target directory"
severity: "medium"
cvss: 6.1
epss: 0.00292
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["compliance-scanning", "infrastructure", "linux", "openscap"]
not_affected_if: ["no-sds-decompose", "self-built-datastreams"]
published_at: "2026-10-21T20:17:27+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:03:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85518", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-85518", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# OpenSCAP: crafted datastream can write files outside the target directory

OpenSCAP does not validate relative file path attributes when decomposing a Source DataStream (SDS) file, so a crafted datastream with directory traversal sequences can make it create or modify files outside the intended directory. The attacker gets those writes with the permissions of the process running the decompose.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85518
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-85518

## From the sources

A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_