{"id":"CVE-2021-3762","aliases":["EUVD-2022-1483","GHSA-mq47-6wwv-v79w","GO-2022-0346"],"status":"published","title":"Path traversal in claircore","description":"A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.04815,"percentile":0.92044,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2022-03-03T21:41:19Z","modified":"2026-10-24T10:50:13Z","fixes":[{"ecosystem":"Go","package":"github.com/quay/claircore","fixed_in":["0.4.8","1.1.0","0.5.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/quay/claircore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/quay/claircore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.1.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/quay/claircore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.0"},{"fixed":"0.5.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/quay/claircore","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/quay/claircore","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.1.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/quay/claircore","ranges":[{"type":"SEMVER","events":[{"introduced":"0.5.0"},{"fixed":"0.5.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/quay/claircore","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}]}],"products":[{"vendor":"redhat","product":"clair"},{"vendor":"redhat","product":"quay"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000795","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/quay/claircore/pull/478","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/quay/clair/pull/1379","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/quay/clair/pull/1380","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/quay/claircore/commit/691f2023a1720a0579e688b69a2f4bfe1f4b7821","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://vulmon.com/exploitdetails?qidtp=maillist_oss_security\u0026qid=d19fce9ede06e13dfb5630ece7f14f83","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3762","tags":["advisory"]},{"url":"https://github.com/quay/claircore/commit/dff671c665141f126c072de8a744855d4916c9c7","tags":["web"]},{"url":"https://github.com/quay/claircore/commit/ed5f52aec1c82746725e9cc23e98316eab8be25a","tags":["web"]},{"url":"https://github.com/quay/claircore/commits/v0.4.8","tags":["web"]},{"url":"https://github.com/quay/claircore/commits/v0.5.5","tags":["web"]},{"url":"https://github.com/quay/claircore/commits/v1.1.0","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0346","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mq47-6wwv-v79w"},{"url":"https://github.com/quay/claircore","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-3762","description":"A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.","status":"published","published":"2022-03-03T21:41:19Z","modified":"2024-08-03T17:09:08.89Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:33:03.671751Z"}],"euvd":[{"id":"EUVD-2022-1483","description":"A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.","status":"published","published":"2022-03-03T21:41:19Z","modified":"2024-08-03T17:09:08Z","updated_at":"2026-11-03T03:25:11.953192Z"}],"ghsa":[{"id":"GHSA-mq47-6wwv-v79w","title":"Path traversal in claircore","description":"A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.","status":"published","published":"2022-03-04T00:00:16Z","modified":"2023-02-06T22:10:09Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:44.093794Z"}],"nvd":[{"id":"CVE-2021-3762","description":"A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.","status":"published","published":"2022-03-03T22:15:08.467Z","modified":"2026-06-17T04:05:43.017Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:05.198719Z"}],"osv":[{"id":"CVE-2021-3762","description":"A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.","status":"published","published":"2022-03-03T22:15:08.467Z","modified":"2026-10-24T10:50:13.14312397Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"GHSA-mq47-6wwv-v79w","title":"Path traversal in claircore","description":"A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.","status":"published","published":"2022-03-04T00:00:16Z","modified":"2023-11-08T04:06:18.944877Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"GO-2022-0346","title":"Path traversal in github.com/quay/claircore","description":"A maliciously crafted RPM file can cause the Scanner.Scan function to write files with arbitrary contents to arbitrary locations on the local filestem.","status":"published","published":"2022-07-15T23:30:27Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}