VDB
CVE-2026-107935
CVE-2026-107935
PUBLISHED
CVSS 9.3 CRITICAL
Reported by redhat · Published October 9, 2026
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
Risk Scores
CVSS 3.1
9.3
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| 0.4.0 | ||
| Red Hat | Red Hat Build of Podman Desktop | |
| Red Hat | Red Hat Certification Program for Red Hat Enterprise Linux 9 | |
| Red Hat | Red Hat Edge Manager 1 | |
| Red Hat | Red Hat Enterprise Linux 10 | |
| Red Hat | Red Hat Enterprise Linux 10 | |
| Red Hat | Red Hat Enterprise Linux 10 | |
| Red Hat | Red Hat Enterprise Linux 10 | |
| Red Hat | Red Hat Enterprise Linux 10 | |
| Red Hat | Red Hat Enterprise Linux 10 | |
| Red Hat | Red Hat Enterprise Linux 10 | |
| Red Hat | Red Hat Enterprise Linux 8 | |
| Red Hat | Red Hat Enterprise Linux 9 | |
| Red Hat | Red Hat Enterprise Linux 9 | |
| Red Hat | Red Hat Hardened Images | |
| Red Hat | Red Hat OpenShift Container Platform 4 | |
| Red Hat | Red Hat OpenShift Container Platform 4 | |
| Red Hat | Red Hat OpenShift Dev Spaces | |
| Red Hat | Red Hat OpenStack Platform 18.0 | |
| Red Hat | Red Hat Enterprise Linux 10 |
…and 19 more
Timeline
- Oct 9, 2026 Coalition ESS Score
- Oct 9, 2026 CVE Published
- Oct 10, 2026 EPSS Score
- Oct 12, 2026 CVE Updated
- Oct 13, 2026 EPSS Score
- Oct 15, 2026 EPSS Score
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
References
- vdb-entryx_refsource_REDHAT
- RHBZ#2548382 issue-trackingx_refsource_REDHAT