PkgSeer

Vulnerability GHSA-q3jc-42cq-33fj

Medium Risk

4 months ago

KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite

v0.0.1-alpha.0 - v1.10.0-rc.0

Summary

KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite

Details

A flaw was found in KubeVirt's virt-handler network cache handling. The writeToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causing virt-handler to follow it and overwrite an arbitrary host file with JSON content and change its ownership.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

KubeVirt has a Link Following issue in kubevirt.io/kubevirt

v0.0.1-alpha.0 - v1.10.0-rc.0 GO-2026-5883

KubeVirt has a Link Following vulnerability in kubevirt.io/kubevirt

v0.0.1-alpha.0 - v1.6.5 and v1.7.0-alpha.0 - v1.7.3 and v1.8.0-alpha.0 - v1.8.2 GO-2026-5848

KubeVirt virt-api port-forward handler vulnerable to SSRF via guest-controlled VMI IP address

v0.0.1-alpha.0 - v1.10.0-beta.0 GHSA-cgm6-wvp9-4g5h

KubeVirt's authorization mechanism improperly truncates subresource names in kubevirt.io/kubevirt

v0.0.1-alpha.0 - v1.10.0-rc.0 GO-2026-5450

KubeVirt has a Link Following issue

v0.0.1-alpha.0 - v1.9.0-beta.0 GHSA-mpmf-3w4r-qfpf

View all vulnerabilities for these packages

Impacted packages

kubevirt.io/kubevirt

Timeline

Published

4 months ago

Last Modified

3 hours ago