CVE-2026-35254: Oracle Cloud Infrastructure CLI Path Traversal

CVE-2026-35254 Overview

CVE-2026-35254 is a path traversal vulnerability [CWE-22] affecting Oracle Cloud Infrastructure Command Line Interface (OCI CLI) version 3.77. The flaw allows an attacker to place imported files outside the intended directory during file import operations. Exploitation requires local access and user interaction, but no authentication or elevated privileges. The vulnerability targets file integrity, with limited impact on availability and no impact on confidentiality. Oracle published the advisory on May 6, 2026, as part of its security alerts program.

Critical Impact
A successful attack lets an unauthenticated user write imported files to arbitrary filesystem locations, enabling overwrite of sensitive files and potential follow-on code execution.

Affected Products

Oracle Cloud Infrastructure CLI version 3.77
Oracle Open Source Projects component (oci-cli)
Deployments using OCI CLI for file import operations

Discovery Timeline

2026-05-06 - CVE CVE-2026-35254 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-35254

Vulnerability Analysis

The vulnerability resides in the file import logic of Oracle OCI CLI 3.77. The CLI processes imported file paths without sufficient sanitization of directory traversal sequences such as ../. An attacker can craft an archive or input file whose internal paths reference parent directories. When the CLI extracts or copies these files, it writes them outside the intended target directory.

The attack vector is local and requires user interaction, meaning a victim must run an OCI CLI command against attacker-supplied input. Successful exploitation produces high integrity impact through arbitrary file writes and low availability impact when critical files are overwritten. Confidentiality is not directly affected, since the bug enables writing rather than reading.

Path traversal flaws in CLI tooling are particularly damaging in CI/CD pipelines and developer workstations, where the CLI typically runs with the user's full filesystem permissions and access to cloud credentials.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The OCI CLI does not canonicalize and validate destination paths before writing imported file contents. Sequences that resolve outside the target directory are accepted by the import routine.

Attack Vector

An attacker prepares a malicious input file or archive containing entries with relative path components that escape the import directory. The attacker delivers this file to a target user through a shared workspace, package, or repository. The user runs an OCI CLI import command against the file. The CLI writes the embedded entries to attacker-controlled paths, which can include shell startup scripts, SSH configuration, or OCI credential files under the user's home directory.

The vulnerability mechanism is described in prose because no public proof-of-concept code is available. Refer to the Oracle Security Alerts Overview for vendor technical details.

Detection Methods for CVE-2026-35254

Indicators of Compromise

Files written outside the intended OCI CLI working directory after an import command
Unexpected modifications to ~/.oci/config, ~/.ssh/, or shell profile files following CLI use
Archive or import inputs containing path entries with ../ or absolute path prefixes

Detection Strategies

Audit OCI CLI version inventory across developer endpoints and build agents to identify version 3.77
Inspect file integrity baselines on systems running OCI CLI for writes outside expected directories
Review shell history and CI logs for oci import subcommands operating on untrusted inputs

Monitoring Recommendations

Monitor process execution of oci binaries and correlate with file create or modify events outside the working directory
Alert on writes to credential and configuration paths originating from OCI CLI processes
Capture command-line telemetry for OCI CLI invocations on build servers and developer workstations

How to Mitigate CVE-2026-35254

Immediate Actions Required

Identify all systems running Oracle OCI CLI version 3.77 and prioritize them for upgrade
Restrict use of OCI CLI import commands against files received from untrusted sources
Run OCI CLI from least-privileged accounts that cannot overwrite system or other users' files

Patch Information

Oracle addresses this vulnerability through its security alert process. Review the Oracle Security Alerts Overview for the fixed OCI CLI release and upgrade instructions. Upgrade beyond version 3.77 to a release containing the path traversal fix.

Workarounds

Validate and canonicalize input file paths before passing them to OCI CLI import operations
Run OCI CLI inside a container or sandbox with a read-only home directory to limit traversal impact
Avoid executing OCI CLI as a privileged user or with write access to sensitive configuration files

bash

# Configuration example: verify installed OCI CLI version and upgrade
oci --version
pip install --upgrade oci-cli
# Run OCI CLI in a constrained working directory
mkdir -p /tmp/oci-import && cd /tmp/oci-import
oci <import-subcommand> --file ./input.file