{"id":"CVE-2026-107935","published":"2026-10-09T10:16:37Z","modified":"2026-10-12T10:16:43Z","title":"A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package","vendor":"Red Hat","product":"Red Hat Build of Podman Desktop","tier":"core","eol":null,"description":{"text":"A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.","provenance":"source","from":"NVD"},"summary":{"text":"A path traversal flaw in gvproxy, the network forwarder shipped with the gvisor-tap-vsock package in Red Hat Build of Podman Desktop, lets the unauthenticated /services/forwarder/expose endpoint accept a caller-supplied socket path without validating it. An attacker with network access to that endpoint, requiring no authentication, no user interaction and no special configuration, can delete arbitrary files on the host system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:21:07Z"},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00239,"percentile":0.14959,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":11,"pulses":[{"name":"Known_Cve | Oct 21, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad781365a703b9c48649e66","created":"2026-10-20"},{"name":"Known_Cve | Oct 20, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad62f6910d6449918d5e634","created":"2026-10-19"},{"name":"Known_Cve | Oct 19, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad4dda86020bf504fd274dd","created":"2026-10-18"},{"name":"Known_Cve | Oct 18, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad38c282daff94afd324191","created":"2026-10-17"},{"name":"Known_Cve | Oct 17, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad23ab08ed96f8b8bdea241","created":"2026-10-16"},{"name":"Known_Cve | Oct 16, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ad0e933fc9a5a47b66d7921","created":"2026-10-15"},{"name":"Known_Cve | Oct 15, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6acf98726e4260f2f2ba3d49","created":"2026-10-14"},{"name":"Known_Cve | Oct 14, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ace4672cf606a4598005652","created":"2026-10-13"},{"name":"Known_Cve | Oct 13, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6accf72a849f791bc729312a","created":"2026-10-12"},{"name":"Known_Cve | Oct 12, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6acba8aca71285f9db866402","created":"2026-10-11"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-107935","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548382","tags":[]},{"url":"https://github.com/containers/gvisor-tap-vsock/pull/718","tags":[]},{"url":"https://redhat.atlassian.net/browse/RHDESK-550","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-95578","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-95578","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107935","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":12.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":2.99,"detail":"percentile 0.1496"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.45,"detail":"11 pulses"},{"name":"CVSS severity","points":6.51,"detail":"base score 9.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}