CVE-2026-111435

EUVD-2026-124257
Relative path traversal vulnerability in openEuler iSulad on Linux.

This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.



This issue affects iSulad: through 2.1.6.



In oci_load.c, oci_load_process_manifest() does not sanitize the Config path of manifest.json. A malicious tar package can enable the isulad with the root permission to read any file on the host.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.4 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 37.37%
Common Weakness Enumeration
References
https://atomgit.com/openeuler/iSulad/commit/370889a81f1e7381de68ad7ded88b3439e266af5?ref=master&prId=2646
https://atomgit.com/src-openeuler/iSulad/pull/812
https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865