Threats tagged 'ghsa-rq79-hchq-wm2f'

CVE-2026-101295 is a path traversal and arbitrary file write vulnerability in oc-mirror's operator catalog image extraction process. The flaw occurs when extracting tar entries from catalog image layers without validating that file paths remain within the intended destination directory. This affects mirroring operator catalogs using either the legacy v1 path or the OCI feature path. A fix is available in Red Hat OpenShift Container Platform 4.13.73.