GHSA-mpmf-3w4r-qfpf

Source

https://github.com/advisories/GHSA-mpmf-3w4r-qfpf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-mpmf-3w4r-qfpf/GHSA-mpmf-3w4r-qfpf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mpmf-3w4r-qfpf

Aliases

CVE-2026-9804
GO-2026-5883

Downstream

CGA (92)

MINI (9)

Published

2026-05-28T09:31:20Z

Modified

2026-09-10T03:51:06Z

Severity

7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator

Summary

KubeVirt has a Link Following issue

Details

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.

Database specific

{
    "cwe_ids":  [
        "CWE-59"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-01T22:01:19Z",
    "nvd_published_at":  "2026-05-28T09:16:49Z",
    "severity":  "HIGH"
}

References

Affected packages

Go / kubevirt.io/kubevirt

Package

Name: kubevirt.io/kubevirt; View open source insights on deps.dev
Purl: pkg:golang/kubevirt.io/kubevirt

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.9.0-beta.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-mpmf-3w4r-qfpf/GHSA-mpmf-3w4r-qfpf.json"