CVE-2026-101295 — Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI featur…
Published: 2026-09-30 · CVSS: 7.3 · CVSS 3.1
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7