GHSA-qg5c-wc5w-5wp2HighCVSS 7.4
Relative path traversal vulnerability in openEuler iSulad on Linux. This vulnerability is...
🔗 CVE IDs covered (1)
📋 Description
Relative path traversal vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.
This issue affects iSulad: through 2.1.6.
In oci_load.c, oci_load_process_manifest() does not sanitize the Config path of manifest.json. A malicious tar package can enable the isulad with the root permission to read any file on the host.
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2026-111435
- https://atomgit.com/openeuler/iSulad/commit/370889a81f1e7381de68ad7ded88b3439e266af5?ref=master&prId=2646
- https://atomgit.com/src-openeuler/iSulad/pull/812
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865
- https://github.com/advisories/GHSA-qg5c-wc5w-5wp2