Is CVE-2026-101295 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-101295?

CVE-2026-101295 has a CVSS v3 severity of HIGH (7.3).

Back

CVE-2026-101295

Description

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.