CVE-2026-35254 Path traversal in Oracle OCI CLI of Oracle Open Source Projects
An unauthenticated attacker can exploit a path traversal flaw in Oracle OCI CLI to place imported files outside the intended directory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-35254?
CVE-2026-35254 is a medium-severity path traversal vulnerability in Oracle OCI CLI of Oracle Open Source Projects, published on 6 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Vulnerability in the Oracle OCI CLI product of Oracle Open Source Projects. The supported versions that is affected is 3.77. Easily exploitable vulnerability allows unauthenticated attacker with network access to compromise Oracle OCI CLI. Successful attacks of this vulnerability can result in Oracle OCI CLI allowing users to place imported files outside the intended directory.
Weakness: CWE-22
Which versions are affected by CVE-2026-35254?
It affects 1 product.
Linux distribution packages (1)
oci-cli openSUSE:Tumbleweed | All versions | 3.83.0-1.1 |
Products include Oracle Cloud Infrastructure Cli.
How do I fix CVE-2026-35254?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-35254 being exploited?
There is no known exploitation of CVE-2026-35254 in the wild and no public exploit code.
Sources
Also known as GHSA-x8v7-mg93-8rrg, openSUSE-SU-2026:10827-1.