OpenSCAP fails to verify relative file‑path attributes when decomposing an SDS file, allowing a crafted stream with directory traversal sequences to create or overwrite files outside the intended extraction directory. The resulting files are written with the permissions of the executing process, enabling an attacker to place or modify arbitrary files, potentially facilitating privilege escalation or compromising system integrity.

Red Hat Enterprise Linux 10,6,7,8,9 and Red Hat Hardened Images that include the vulnerable OpenSCAP component.

The CVSS score is 6.1, indicating medium severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, implying no widespread exploitation yet. The flaw requires the attacker to supply or trick a user or automated system into decomposing a crafted SDS file, so local influence is needed. If the decomposing process runs with elevated privileges, the attacker can write files with system rights, potentially leading to full system compromise; otherwise the damage is limited to the rights of the user performing the extraction.