Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

Google OSV‑SCALIBR can overwrite files when unpacking remote images

CVE-2025-5981 · published 1 year ago
Summary

The OSV‑SCALIBR tool from Google can write files anywhere on the host if it processes an untrusted container image using the --remote-image option. This could let an attacker place or modify files, potentially compromising the system. Update to the latest version and only use images from trusted sources, or avoid the --remote-image flag for unknown images.

What to do
  • Update github.com google to version 0.2.1.
  • Update google osv-scalibr to version 0.1.8 or later.
Affected software
Ecosystem VendorProductAffected versions
go github.com google >= 0.1.3, < 0.2.1
Fix: upgrade to 0.2.1
– google osv-scalibr >= 0.1.3, < 0.1.8
cpe:2.3:a:google:osv-scalibr:*:*:*:*:*:go:*:*
Original advisory text
Arbitrary File write in OSV-SCALIBR
Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
CWE-427Uncontrolled Search Path Element
Timeline
Published18 Jun 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-2hcm-q3f4-fjgw · GHSA
CVE-2025-5981 · NVD
CVE-2025-5981 · OSV
Track software like this
Free during beta