CVE-2026-85518
Medium
Description
A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.
SeverityMedium
CVSS6.1
Exploit probability—
Product
Red Hat Hardened Images
PublishedOct 21, 2026
First seenOct 21, 2026
Weakness typeCWE-22Path traversal
How to fix
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Red Hat Hardened Images | No range specified | — |
| Red Hat Red Hat Enterprise Linux 10 | No range specified | — |
| Red Hat Red Hat Enterprise Linux 7 | No range specified | — |
| Red Hat Red Hat Enterprise Linux 8 | No range specified | — |
| Red Hat Red Hat Enterprise Linux 9 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.