Filesystem Traversal Vulnerability in OSV-SCALIBR by Google

CVE-2025-13425

What is CVE-2025-13425?

A vulnerability in OSV-SCALIBR related to filesystem traversal is caused by a bug in the fallback path for directory iteration. This issue arises when the ReadDir function returns nil for an empty directory. Consequently, the code attempts to overindex an empty slice, leading to a runtime panic (index out of range) that results in an application crash or denial of service. This can disrupt the normal functioning of applications utilizing OSV-SCALIBR, creating potential service outages.

References