CyberRota Analysis
AI-GeneratedThe vulnerability allows for path traversal and arbitrary file writes during the extraction of operator catalog images in oc-mirror, as it fails to validate file paths, potentially leading to unauthorized file access or system compromise. Organizations utilizing oc-mirror for catalog image management should prioritize addressing this issue to mitigate risks associated with unauthorized file manipulation and system integrity breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.