CVE-2026-107935 PUBLISHED

Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

Assigner: redhat
Reserved: 09.10.2026 Published: 09.10.2026 Updated: 09.10.2026

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.

Metrics

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
CVSS Score: 9.3

Product Status

Vendor Red Hat
Product Red Hat Build of Podman Desktop
Versions Default: affected
Vendor Red Hat
Product Red Hat Certification Program for Red Hat Enterprise Linux 9
Versions Default: unknown
Vendor Red Hat
Product Red Hat Edge Manager 1
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: unknown
Vendor Red Hat
Product Red Hat Hardened Images
Versions Default: unknown
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: unknown
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: unknown
Vendor Red Hat
Product Red Hat OpenShift Dev Spaces
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenStack Platform 18.0
Versions Default: unknown

Credits

  • This issue was discovered by Lucas Celant (Red Hat).

References

Problem Types

  • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE