CVE-2025-5981

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-427 CWE-22

Affected software

Vendor	Product	Versions
Google	osv-scalibr	>= 0.1.3, < 0.1.8

References

Timeline

Published: Jun 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-598106.5An improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS CVE-2025-598148.8This vulnerability allows malicious actors to gain unauthorized access to the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, enab CVE-2025-598158.4This vulnerability allows malicious actors to execute arbitrary commands on the underlying system of the Zenitel ICX500 and ICX510 Gateway, CVE-2025-598167.3This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin d CVE-2025-598178.4This vulnerability allows attackers to execute arbitrary commands on the underlying system. Because the web portal runs with root privileges CVE-2025-598189.8This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded CVE-2025-598196.5This vulnerability allows authenticated attackers to read an arbitrary file by changing a filepath parameter into an internal system path.CVE-2025-59827.5An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Und CVE-2025-598206.7In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.CVE-2025-598216.1DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, DNN’s CVE-2025-598227.5Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTT CVE-2025-598239.9Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Ga