Relative Path Traversal Vulnerability in openEuler iSulad on Linux

CVE-2026-111435

What is CVE-2026-111435?

A relative path traversal vulnerability exists in openEuler’s iSulad that permits unauthorized access to sensitive files on the host system. This issue arises from insufficient sanitization of the Config path in the manifest.json, particularly within the oci_load_process_manifest() function in the oci_load.c file. Exploiting this vulnerability, a malicious tar package can be used to elevate permissions, enabling the iSulad daemon to read arbitrary files with root-level access.

References