CVE-2026-9804

7.7 HIGH

A flaw was found in KubeVirt's virt-exportserver component

Published: 2026-05-28 · Last updated: 2026-05-28

Severity and scoring

CVSS: 7.7 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE: CWE-59

Description

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.

Source: NVD

References

Related CVEs

Same CWE

CVE-2026-50656 — Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as ... (7.8 HIGH)
CVE-2026-54230 — A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport (7.0 HIGH)
CVE-2026-54056 — Kitty is a cross-platform GPU based terminal (7.6 HIGH)
CVE-2026-54055 — Kitty is a cross-platform GPU based terminal (5.0 MEDIUM)
CVE-2025-46293 — This issue was addressed with improved handling of symlinks (5.5 MEDIUM)