CVE-2026-65950: Path Traversal (Zip Slip) in Lenovo XClarity OneCLI 5.5.0 Linux

Published Nov 11, 2026

Updated

A path traversal vulnerability in the ZIP extraction logic of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to write arbitrary files with the privileges of the OneCLI process by convincing a user to process a specially crafted ZIP-based update package.

Event History

Nov 11, 2026

CVE Published

via MITRE·09:12 PM

Data Sourced

via MITRE·09:12 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker must convince a user to process a specially crafted ZIP-based update package. Exploitation also requires the privileges needed to use the affected OneCLI process.

What is the impact if exploitation succeeds?

A crafted archive can cause arbitrary files to be written outside the intended extraction path. The files are written with the privileges of the OneCLI process, which can affect system integrity and availability.

Which deployment is identified as affected?

The affected product identified is Lenovo XClarity Essentials OneCLI 5.5.0 for Linux. The provided information does not identify other versions or operating systems.

CVE-2026-65950: Path Traversal (Zip Slip) in Lenovo XClarity OneCLI 5.5.0 Linux

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

What is the impact if exploitation succeeds?

Which deployment is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

What is the impact if exploitation succeeds?

Which deployment is identified as affected?