CRITICAL 9.3 NVD
CVE-2026-107935
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/exp
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
References
- https://access.redhat.com/security/cve/CVE-2026-107935
- https://bugzilla.redhat.com/show_bug.cgi?id=2548382
- https://github.com/containers/gvisor-tap-vsock/pull/718
- https://redhat.atlassian.net/browse/RHDESK-550
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-10-09 via NVD.
Risk Timeline
CVE Disclosed2026-10-09 · 2 days ago
Remediation Resources
Official Advisory
access.redhat.com/security/cve/CVE-2026-107935Analysis & PoC
bugzilla.redhat.com/show_bug.cgi?id=2548382Analysis & PoC
redhat.atlassian.net/browse/RHDESK-550
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.