Path Traversal and Arbitrary File Write Vulnerability in OpenShift oc-mirror
CVE-2026-101295

7.3HIGH

Key Information:

Vendor: Red Hat
Status: Assisted Installer For Red Hat Openshift Container Platform 2; Red Hat Openshift Container Platform 4
Vendor: CVE Published:; 30 September 2026

What is CVE-2026-101295?

A vulnerability exists in OpenShift's oc-mirror that allows for path traversal and arbitrary file write due to improper validation of file paths when extracting tar entries from catalog image layers. This occurs during the mirroring of operator catalogs, both through the legacy v1 path and the OCI feature path. Attackers could exploit this flaw to write files outside the intended directory, potentially compromising the system's integrity.