Veille CVE
CVE-2026-107935
9.3 CritiqueDescription
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
Produits concernés
- Red Hat Build of Podman Desktop
- Red Hat Certification Program for Red Hat Enterprise Linux 9
- Red Hat Edge Manager 1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Dev Spaces
- Red Hat OpenStack Platform 18.0
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.3 Critique | secalert@redhat.com | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H |