CVE-2026-107935

CRITICAL

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.

CVSS v3.1 Score

9.3
CRITICAL
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Attack Vector
ADJACENT_NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
HIGH
Published: 10/9/2026Modified: 10/12/2026

Related Intelligence (0)

No articles currently reference this CVE.

References (4)

https://access.redhat.com/security/cve/CVE-2026-107935https://bugzilla.redhat.com/show_bug.cgi?id=2548382https://github.com/containers/gvisor-tap-vsock/pull/718https://redhat.atlassian.net/browse/RHDESK-550