CVE-2026-111435

Relative path traversal vulnerability in openEuler iSulad on Linux.

This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.

This issue affects iSulad: through 2.1.6.

In oci_load.c, oci_load_process_manifest() does not sanitize the Config path of manifest.json. A malicious tar package can enable the isulad with the root permission to read any file on the host.