https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 02:13:14 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-101295 <p>Path traversal / arbitrary file write in oc-mirror&#39;s operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.</p> <p>Path traversal / arbitrary file write in oc-mirror&#39;s operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-101295 https://vulnerability.circl.lu/vuln/ghsa-rq79-hchq-wm2f <p>Path traversal / arbitrary file write in oc-mirror&#39;s operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.</p> <p>Path traversal / arbitrary file write in oc-mirror&#39;s operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.</p> https://vulnerability.circl.lu/vuln/ghsa-rq79-hchq-wm2f