This vulnerability affects Oracle OCI CLI version 3.77. An unauthenticated attacker with network access can exploit this flaw to cause the CLI to place imported files outside the intended directory, potentially compromising the integrity of the system. The CVSS 3.1 base score is 6.1 (medium severity) with attack vector local, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. Oracle has not published an official patch or detailed remediation guidance for this vulnerability in their public advisories, and it is not a cloud service where vendor-managed remediation would apply.

Successful exploitation allows unauthorized placement of files outside the intended directory by Oracle OCI CLI, which can compromise system integrity. There is no confidentiality impact, but integrity is rated high and availability low. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Oracle advisory page for current remediation guidance: https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html. Until an official fix is available, limit network access to Oracle OCI CLI instances and monitor for unusual file placement activities. No vendor advisory states that no action is required or that the issue is already mitigated.