CVE-2026-107935
Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
- Record
CVE-2026-107935- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-04
EUVDEUVD-2026-95578
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
- Record
EUVD-2026-95578- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-hp8g-9vjx-j62m
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor...
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
- Record
GHSA-hp8g-9vjx-j62m- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
- Record
CVE-2026-107935- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-04
OSVALPINE-CVE-2026-107935
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
- Record
ALPINE-CVE-2026-107935- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2026-107935
- Record
BELL-CVE-2026-107935- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSV
Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
- Record
CVE-2026-107935- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-107935
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
- Record
DEBIAN-CVE-2026-107935- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H - Updated
- 2026-11-05
OSVUBUNTU-CVE-2026-107935
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
- Record
UBUNTU-CVE-2026-107935- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12370-1 No score
podman-6.1.4-1.1 on GA media
These are all security issues fixed in the podman-6.1.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12370-1- Updated
- 2026-11-02
Affected products
- red hat build of podman desktop
- red hat certification program for red hat enterprise linux 9
- red hat edge manager 1
- red hat enterprise linux 10
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat hardened images
- red hat openshift container platform 4
- red hat openshift container platform 5
- red hat openshift dev spaces
- red hat openstack platform 18.0
Affected packages
| Package | Affected | Fixed |
|---|---|---|
podmanAlpine:v3.24 |
before 5.8.9-r0 | 5.8.9-r0 |
podmanAlpaquita:stream |
4.5.1-r1 up to 6.1.4-r0 | 6.1.4-r0 |
golang-github-containers-gvisor-tap-vsocksDebian:13 |
All versions, plus listed versions 0.8.1-30.8.1-40.8.1-50.8.1-6 |
None known |
golang-github-containers-gvisor-tap-vsocksDebian:14 |
All versions, plus listed versions 0.8.1-30.8.1-40.8.1-50.8.1-6 |
None known |
golang-github-containers-gvisor-tap-vsocksUbuntu:24.04:LTS |
All versions, plus listed versions 0.7.1+ds1-20.7.2+ds1-1 |
None known |
golang-github-containers-gvisor-tap-vsocksUbuntu:26.10 |
All versions, plus listed versions 0.8.1-3build10.8.1-4 |
None known |
golang-github-containers-gvisor-tap-vsocksUbuntu:26.04:LTS |
All versions, plus listed versions 0.8.1-30.8.1-3build1 |
None known |
podmanopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 6.1.4-1.1 | 6.1.4-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | EUVD, NVD, OSV | |
| facts, products | CVE List | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-107935 is a critical vulnerability (CVSS 9.3) in Red Hat Build Of Podman Desktop, published October 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in podman 5.8.9-r0.
References
access.redhat.com/security/cve/CVE-2026-107935
bugzilla.redhat.com/show_bug.cgi?id=2548382
github.com/containers/gvisor-tap-vsock/pull/718
redhat.atlassian.net/browse/RHDESK-550
nvd.nist.gov/vuln/detail/CVE-2026-107935
Show 10 moreShow less
security.alpinelinux.org/vuln/CVE-2026-107935
docs.bell-sw.com/security/cves/CVE-2026-107935
security-tracker.debian.org/tracker/CVE-2026-107935
ubuntu.com/security/CVE-2026-107935
cve.org/CVERecord?id=CVE-2026-107935
suse.com/security/cve/CVE-2026-107935