CVE-2026-111435

CVSS 7.4 (high) · published 2026-11-12

Relative path traversal vulnerability in openEuler iSulad on Linux. This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c. This issue affects iSulad: through 2.1.6. In oci_load.c, oci_load_process_manifest() does not sanitize the Config path of manifest.json. A malicious tar package can enable the isulad with the root permission to read any file on the host.

Weakness: CWE-23

Source: NVD CVE-2026-111435

References

• https://atomgit.com/openeuler/iSulad/commit/370889a81f1e7381de68ad7ded88b3439e266af5?ref=master&prId=2646
• https://atomgit.com/src-openeuler/iSulad/pull/812
• https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.