{"id":"CVE-2026-107935","summary":"Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose","details":"A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.","modified":"2026-10-14T02:30:53.424521456Z","published":"2026-10-09T09:05:43.726Z","database_specific":{"cna_assigner":"redhat","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107935.json"},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://redhat.atlassian.net/browse/RHDESK-550"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-107935"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107935.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107935"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548382"},{"type":"FIX","url":"https://github.com/containers/gvisor-tap-vsock/pull/718"},{"type":"PACKAGE","url":"https://github.com/containers/gvisor-tap-vsock"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/containers/gvisor-tap-vsock","events":[{"introduced":"eb4a6b09b9d5b02b907a257ac55d7d461cae544b"},{"fixed":"6dbb5d4fa0033356c72a201346f8350594229868"}],"database_specific":{"extracted_events":[{"introduced":"0.4.0"},{"fixed":"0.9.0"}],"source":"AFFECTED_FIELD"}}],"versions":["v0.8.8","v0.8.7","v0.8.6","v0.8.5","v0.8.4","v0.8.3","v0.8.2","v0.8.1","v0.8.0","v0.7.5","v0.7.4","v0.7.3","v0.7.2","v0.7.1","v0.7.0","v0.6.2","v0.6.1","v0.6.0","v0.5.0","v0.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107935.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H"}]}