https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:13:10 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-366110 EUVD-2026-366110 https://cve.radiocsirt.org/vuln/euvd-2026-366110 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9804 <p>A flaw was found in KubeVirt&#39;s virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod&#39;s filesystem. This leads to information disclosure, potentially exposing sensitive data.</p> <p>A flaw was found in KubeVirt&#39;s virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod&#39;s filesystem. This leads to information disclosure, potentially exposing sensitive data.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-9804 https://cve.radiocsirt.org/vuln/ghsa-mpmf-3w4r-qfpf <p><strong>Affected:</strong> Go: kubevirt.io/kubevirt</p> <p>A flaw was found in KubeVirt&#39;s virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod&#39;s filesystem. This leads to information disclosure, potentially exposing sensitive data.</p> <p><strong>Affected:</strong> Go: kubevirt.io/kubevirt</p> <p>A flaw was found in KubeVirt&#39;s virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod&#39;s filesystem. This leads to information disclosure, potentially exposing sensitive data.</p> https://cve.radiocsirt.org/vuln/ghsa-mpmf-3w4r-qfpf https://cve.radiocsirt.org/vuln/msrc_cve-2026-9804 msrc_CVE-2026-9804 https://cve.radiocsirt.org/vuln/msrc_cve-2026-9804 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11015-1 <p>kubevirt-container-disk-1.8.3-1.1 on GA media</p> <p>kubevirt-container-disk-1.8.3-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11015-1 https://cve.radiocsirt.org/vuln/rhsa-2026:27903 <p>kubevirt: kubevirt: VMExport directory symlink escape enables exporter pod file read Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code</p> <p>kubevirt: kubevirt: VMExport directory symlink escape enables exporter pod file read Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code</p> https://cve.radiocsirt.org/vuln/rhsa-2026:27903