CVE-2025-5981

Published: Jun 18, 2025

Modified: Jun 18, 2025

PUBLISHED

Description

Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images.

Vendor	Product	Versions
Google	osv-scalibr	affected `0.1.3 - < 0.1.8`

Weaknesses (CWE)

CWE-427

References

https://github.com/google/osv-scalibr/releases/tag/v0.1.8

https://github.com/google/osv-scalibr/commit/2444419b1818c2d6917fc3394c947fb3276e9d59

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2025-5981

Description

Affected Products

Weaknesses (CWE)

References