PkgSeer

Vulnerability GHSA-mpmf-3w4r-qfpf

High Risk

5 months ago

KubeVirt has a Link Following issue

v0.0.1-alpha.0 - v1.9.0-beta.0

Summary

KubeVirt has a Link Following issue

Details

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

KubeVirt has a Link Following issue in kubevirt.io/kubevirt

v0.0.1-alpha.0 - v1.10.0-rc.0 GO-2026-5883

KubeVirt has a Link Following vulnerability in kubevirt.io/kubevirt

v0.0.1-alpha.0 - v1.6.5 and v1.7.0-alpha.0 - v1.7.3 and v1.8.0-alpha.0 - v1.8.2 GO-2026-5848

KubeVirt virt-api port-forward handler vulnerable to SSRF via guest-controlled VMI IP address

v0.0.1-alpha.0 - v1.10.0-beta.0 GHSA-cgm6-wvp9-4g5h

KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite

v0.0.1-alpha.0 - v1.10.0-rc.0 GHSA-q3jc-42cq-33fj

KubeVirt's authorization mechanism improperly truncates subresource names in kubevirt.io/kubevirt

v0.0.1-alpha.0 - v1.10.0-rc.0 GO-2026-5450

View all vulnerabilities for these packages

Impacted packages

kubevirt.io/kubevirt

Timeline

Published

5 months ago

Last Modified

1 month ago