CVE-2026-107935
Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose
Unknown product
CVSS
9.3CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.9.0CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
Text from CVE List
Affected versions 1
- Productaffected: 0.4.0 before 0.9.0CVE List