Most recent entries from all

EUVD-2026-232063

fkie_cve-2022-1798

A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible.

Withdrawn: GHSA-cvx8-ppmc-78hm — Duplicate Advisory: KubeVirt arbitrary host file read from the VM

Withdrawn by the publisher.

Affected: Go: kubevirt.io/kubevirt

## Duplicate Advisory This advisory is a duplicate of [GHSA-qv98-3369-g364](https://github.com/advisories/GHSA-qv98-3369-g364). This link is maintained to preserve external references.

## Original Description

**Summary** As part of a Kubevirt audit performed by NCC group, a finding dealing with systemic lack of path sanitization which leads to a path traversal was identified. Google tested the exploitability of the paths in the audit report and identified that when combined with another vulnerability one of the paths leads to an arbitrary file read on the host from the VM.

The read operations are limited to files which are publicly readable or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible.

**Severity**

Moderate - The vulnerability is proven to exist in an open source version of KubeVirt by NCC Group while being combined with Systemic Lack of Path Sanitization, which leads to Path traversal.

**Proof of Concept**

The initial VMI specifications can be written as such to reproduce the issue:

```

apiVersion: kubevirt.io/v1 kind: VirtualMachineInstance metadata: name: vmi-fedora spec: domain: devices: disks: - disk: bus: virtio name: containerdisk - disk: bus: virtio name: cloudinitdisk - disk: bus: virtio name: containerdisk1 rng: {} resources: requests: memory: 1024M terminationGracePeriodSeconds: 0 volumes: - containerDisk:…

gsd-2022-1798

msrc_CVE-2022-1798 — Path Traversal vulnerability in Kubevirt

msrc_CVE-2022-1798

RHSA-2022:6351 — Red Hat Security Advisory: OpenShift Virtualization 4.10.5 Images security and bug fix update

kubeVirt: Arbitrary file read on the host from KubeVirt VMs go-restful: Authorization Bypass Through User-Controlled Key

SUSE-SU-2022:3321-1 — Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-cont…

Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container

WID-SEC-W-2022-1312 — Red Hat OpenShift: Mehrere Schwachstellen

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Informationen offenzulegen und Sicherheitsmaßnahmen zu umgehen.