← CVE Intelligence

CVE-2026-9804

Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read PUBLISHED

Description (CNA)

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat Container Native Virtualization 4.17unaffected 1781757410 before *
Red Hat / Red Hat Container Native Virtualization 4.18unaffected 1781928221 before *
Red Hat / Red Hat Container Native Virtualization 4.19unaffected 1781590993 before *
Red Hat / Red Hat Container Native Virtualization 4.20unaffected 1781838712 before *
Red Hat / Red Hat Container Native Virtualization 4.21unaffected 1782012918 before *
Red Hat / Red Hat OpenShift Virtualization 4affected

CWE

CWE-59

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.