CVE-2026-58302: Unvalidated Dlopen Relative Path

Constructing a path for dlopen using an unvalidated user-supplied string can allow an attacker to load arbitrary shared libraries via path traversal.

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0C++
greprules fetch cve-2026-58302-unvalidated-dlopen-relative-path --engine opengrep

Description

Constructing a path for dlopen using an unvalidated user-supplied string can allow an attacker to load arbitrary shared libraries via path traversal.