Path Traversal in oc-mirror Operator Catalog Extraction (CVE-2026-101295)
CVE-2026-101295 Published on September 30, 2026

Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.

NVD

Vulnerability Analysis

CVE-2026-101295 can be exploited with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and a small impact on availability.

Exploitation:
NONE
Automatable:
NO
Technical Impact:
TOTAL
Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
LOW

Timeline

Reported to Red Hat.

Made public. 37 days later.

Weakness Type

What is a Directory traversal Vulnerability?

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVE-2026-101295 has been classified to as a Directory traversal vulnerability or weakness.


Products Associated with CVE-2026-101295

stack.watch emails you whenever new vulnerabilities are published in Red Hat Assisted Installer or Red Hat Openshift. Just hit a watch button to start following.

Red Hat Assisted Installer
Red Hat Openshift

Affected Versions

Assisted Installer for Red Hat OpenShift Container Platform 2: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 5:

Exploit Probability

EPSS
0.15%
Percentile
3.83%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.