CVE-2025-5981 Arbitrary File write in OSV-SCALIBR
Attackers can write arbitrary files on the host system via path traversal when scanning untrusted container images with the remote-image flag.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-5981?
CVE-2025-5981 is a medium-severity path traversal vulnerability in Google osv-scalibr, published on 18 Jun 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images.
Which versions are affected by CVE-2025-5981?
3 open source packages ship an affected version, including github.com/google/osv-scalibr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/google/osv-scalibr Go | From 0.1.3 | 0.2.1 |
github.com/google/osv-scalibr Go | From 0.1.3 | 0.2.1 |
github.com/google/osv-scalibr Go | From 0.1.3 | 0.2.1 |
Products include Google Osv-Scalibr.
How do I fix CVE-2025-5981?
Upgrade github.com/google/osv-scalibr to 0.2.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-5981 being exploited?
There is no known exploitation of CVE-2025-5981 in the wild and no public exploit code.
Sources
Also known as GHSA-2hcm-q3f4-fjgw, GO-2025-3767.