CVE-2026-85518: Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-21 · updated 2026-10-29
Weakness: CWE-22

Description

A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.

Affected products

Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions
Red Hat Enterprise Linux 9: all versions
Red Hat Hardened Images: all versions — fixed in 1.4.5-2.1.hum1

How to fix

Upgrade to a fixed version: Red Hat Hardened Images 1.4.5-2.1.hum1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-85518 or the next vulnerability affects your stack